In a significant cybersecurity incident, researchers have linked the exploitation of a patched vulnerability in VMware vCenter to a suspected Chinese advanced persistent threat (APT) group. The flaw, identified as CVE-2026-59310, carries a critical CVSS score of 9.8 and enables directory traversal attacks that can lead to arbitrary code execution. Broadcom addressed this issue with a patch released on July 29, 2026.
Details of the Exploitation
The cybersecurity firm QUIRSO has assessed, with moderate confidence, that the campaign leveraging CVE-2026-59310 is facilitated by threat actors fluent in Chinese. They are likely operating within the UTC+08:00 time zone, commonly used in China. This conclusion is drawn from various indicators, such as Chinese-language artifacts in scripts, the reuse of research from Chinese sources, and the absence of attacks targeting systems within mainland China.
This campaign began exploiting the flaw merely five days after its public disclosure, affecting 361 victim IP addresses in 47 countries. Nations such as Germany, the U.S., Turkey, Iran, and France were among the hardest hit, with significant numbers of compromised systems.
Technical Analysis of the Attack
QUIRSO’s analysis reveals that compromised vCenter servers were targeted using both CVE-2026-59310 and another flaw, CVE-2026-59309, which allows authentication bypass. Evidence shows malicious activities tied to CVE-2026-59309 as early as August 1, 2026. This included creating an administrative account from an IP address associated with suspicious activity.
The exploitation of CVE-2026-59310 involved manipulating the cron daemon to execute a backdoor downloaded from a remote server. The attackers used naming conventions that mimic VMware’s syslog file structure, suggesting a sophisticated attempt to embed malicious files within privileged execution paths.
Ransomware Deployment and Observations
The attack culminated in the deployment of ransomware on ESXi hosts, encrypting files with the .babyk extension, commonly associated with Babuk-derived ransomware. QUIRSO has not confirmed whether this was the primary goal of the operation or a diversion tactic to hinder forensic analysis by encrypting log files and concealing attacker activities.
Further investigation revealed the use of cron jobs to execute malicious payloads, including scripts that enabled persistent access and deployed reverse SSH binaries. These actions were part of a broader effort to maintain control over compromised systems while blending in with legitimate VMware operations.
Conclusion and Implications
This cyber attack underscores the persistent threat posed by sophisticated APT groups exploiting vulnerabilities in widely-used software platforms. The rapid exploitation of the VMware vCenter flaw highlights the need for timely patch management and comprehensive security measures to protect critical infrastructure. As the investigation continues, understanding the full scope and objectives of this operation remains crucial for enhancing defenses against future incidents.
