![\"Technical](\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/08\/vmware-babuk-inline.jpg\")
<\/p>\nA new campaign targeting VMware vCenter shows how threat actors can turn a core infrastructure flaw into a path for takeover, persistence and ransomware deployment across virtualized environments. According to The Hacker News, researchers at QUIRSO assess with moderate confidence that the activity exploiting CVE-2026-59310 is linked to a Chinese-speaking actor, likely operating in the UTC+08:00 time zone.<\/p>\n
The important point is not only the 9.8 CVSS vulnerability. It is the post-exploitation chain: creating administrator accounts, installing backdoors, using cron and systemd for persistence, deploying reverse SSH, placing web shells, collecting vCenter credentials and ultimately enabling Babuk-derived ransomware on ESXi hosts.<\/p>\n
<\/p>\n
Broadcom released a fix for CVE-2026-59310 on July 29, 2026. The flaw is a directory traversal vulnerability in VMware vCenter Server that can be abused for remote code execution. According to QUIRSO, exploitation activity began about five days after details of the issue became public.<\/p>\n
The Hacker News cited earlier analysis saying the campaign affected 361 unique victim IP addresses across 47 countries. Germany, the United States, Turkey, Iran and France were among the countries with the highest observed victim counts. That distribution suggests a broad exploitation campaign rather than an isolated intrusion.<\/p>\n
QUIRSO did not name a specific group, but it highlighted several signals pointing toward a China-linked actor: Chinese-language artifacts in attacker-created scripts, apparent reuse of research from a Chinese security publication, repeated use of Chinese-language tools and management software, victimology excluding mainland China and activity patterns compatible with UTC+08:00 working hours.<\/p>\n
This kind of attribution should be treated carefully. In cybersecurity, language, tooling and time zone data are probability signals, not absolute proof. Still, when several independent indicators converge, they help defenders understand the likely operating model, target selection and technical maturity of the adversary.<\/p>\n
On one analyzed vCenter Server Appliance, QUIRSO observed evidence related to both CVE-2026-59310 and CVE-2026-59309. For CVE-2026-59309, the attacker appears to have created a new vCenter administrator account and used a User-Agent such as GoodMoodle-VCFleet\/1.0<\/strong> to make vSphere discovery traffic look related to VMware Cloud Foundation.<\/p>\n For CVE-2026-59310, the first observed activity involved cron logging a malformed file named zz-poc59310-syslog.log<\/strong>. A later curl or wget command downloaded a backdoor from attacker infrastructure and removed traces. The filename suggests rapid weaponization of public proof-of-concept details after disclosure.<\/p>\n The implant known as linuxFile<\/strong> can receive remote commands over a WebSocket channel, execute them through \/bin\/sh<\/strong> and send results back to command infrastructure. Its C2 address is XOR-obfuscated and decoded at runtime, while communications use the malware's own application-layer cryptography despite relying on unencrypted ws transport.<\/p>\n The actor also relied heavily on cron to download scripts, deploy architecture-specific reverse SSH binaries, drop a JSP web shell, add SSH keys to authorized keys, create vSphere accounts such as adminuser<\/strong> and vcadmin<\/strong>, while granting passwordless sudo access to the service account: perfcharts<\/strong>. These steps point to long-term control, not merely one-time code execution.<\/p>\n The final observed stage involved ransomware on ESXi hosts, encrypting files with the extension: .babyk<\/strong>, a marker commonly associated with Babuk-derived variants. QUIRSO has not concluded that ransomware was necessarily the main goal of the campaign.<\/p>\n One important possibility is that the ransomware was used as a smokescreen to disrupt analysis, destroy ESXi logs and reduce forensic visibility into earlier activity. If so, encryption damage may be only the visible surface, while the deeper objective could involve persistence, credential theft or longer-term espionage preparation.<\/p>\n VMware vCenter is a sensitive control point for virtualized infrastructure. Once vCenter is compromised with root or administrator-level access, attackers can reach ESXi hosts, service accounts, vSphere APIs and other critical management layers. Patching therefore needs to be paired with compromise assessment, not treated as the end of the response.<\/p>\n Organizations should review newly created administrator accounts, unusual cron and systemd entries, unknown JSP files, new SSH keys, local ESXi accounts, unexpected sudo rules, reverse SSH connections and User-Agents that mimic VMware components. For exposed systems, rotating vCenter credentials and checking vmdir integrity should be treated as high-priority tasks.<\/p>\n This VMware vCenter campaign is a reminder that flaws in infrastructure management platforms can create blast effects far beyond a single server. When an actor combines fast exploitation, legitimate administration tools, layered persistence and Babuk-derived ransomware, defenders need to investigate the entire virtualization environment, not only restore encrypted machines.<\/p>\n VNCyberS<\/strong> compiled from The Hacker News and QUIRSO<\/em><\/p>","protected":false},"excerpt":{"rendered":" This VMware vCenter exploitation campaign shows how a suspected China-nexus actor gained persistence, escalated control and deployed Babuk-derived ransomware on ESXi.<\/p>","protected":false},"author":2,"featured_media":1946,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[653,657,655,652,651,654,656,658,650,114],"class_list":["post-1947","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-babuk","tag-broadcom-vmware","tag-china-nexus-apt","tag-cve-2026-59309","tag-cve-2026-59310","tag-esxi-ransomware","tag-quirso","tag-reverse-ssh","tag-vmware-vcenter","tag-vncybers"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1947","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1947"}],"version-history":[{"count":2,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1947\/revisions"}],"predecessor-version":[{"id":1949,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1947\/revisions\/1949"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1946"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1947"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1947"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1947"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Backdoors, persistence and administrator control<\/h2>\n
Babuk-derived ransomware may be a smokescreen<\/h2>\n
Defensive lessons for enterprises<\/h2>\n
Conclusion<\/h2>\n