China-Linked Actor Exploits VMware vCenter Flaw, Deploys Babuk Ransomware Variant

Key Takeaways

• Critical flaw patched: CVE‑2026‑59310 (CVSS 9.8) is a directory‑traversal vulnerability in Broadcom VMware vCenter that allows unauthenticated remote code execution; a fix was released on 29 July 2026.
• Attribution clues: QUIRSO assesses with moderate confidence that a Chinese‑speaking APT operating in the UTC+08:00 time zone is behind the exploitation, based on language artifacts, tool reuse, and victimology.
• Broad impact: Within five days of public disclosure, the campaign compromised 361 unique IP addresses across 47 countries, with the highest concentrations in Germany, the U.S., Turkey, Iran, and France.
• Dual‑CVE exploitation: At least one system was also hit by CVE‑2026‑59309 (authentication bypass), which enabled the creation of a rogue administrative account before the main CVE‑2026‑59310 chain began.
• Attack flow: Initial foothold via a malicious cron job, followed by cron‑based download and execution of backdoors, persistence mechanisms (systemd service, sudoers tampering), credential harvesting, and lateral movement that ultimately deploys a Babuk‑derived ransomware encrypting files with the .babyk extension.
• Defense evasion: The threat actor masquerades malicious files as legitimate VMware components, uses overlapping cron names, and abuses vCenter APIs to blend activity with normal operations.
• Recommendations: Apply the July 2026 patch immediately, enforce least‑privilege accounts, monitor cron and systemd for unauthorized jobs, restrict outbound connections to unknown IPs, and audit vCenter for unexpected administrative accounts or sudoers changes.

Overview of the Vulnerability and Patch
CVE‑2026‑59310 is a severe directory‑traversal flaw in the VMware vCenter Server appliance that scores 9.8 on the CVSS scale. The vulnerability permits an unauthenticated attacker to write arbitrary files to privileged locations and, consequently, execute code with root privileges. Broadcom released a security update addressing this issue on 29 July 2026. Despite the prompt patch, threat actors began exploiting the flaw just five days after its public disclosure, indicating a rapid weaponization cycle.

Attribution to China‑Nexus APT
QUIRSO analysts concluded with moderate confidence that the activity is linked to a Chinese‑speaking advanced persistent threat (APT) operating from the UTC+08:00 time zone, which covers mainland China, Taiwan, Singapore, and similar regions. Their assessment rests on several converging indicators: Chinese‑language strings embedded in attacker‑generated scripts, reuse of research from a Chinese security publication, consistent use of Chinese‑language tools, a victim set that excludes mainland China, and activity patterns aligning with typical business hours in UTC+08:00.

Scope of the Campaign
From early August 2026 onward, the campaign compromised 361 distinct victim IP addresses spread across 47 countries. The most affected nations were Germany (55 victims), the United States (41), Turkey (38), Iran (26), and France (25). This wide geographic distribution suggests opportunistic scanning of internet‑exposed vCenter instances rather than a highly targeted operation against a specific sector.

Exploitation of CVE‑2026‑59309
Before the main CVE‑2026‑59310 chain, at least one system was also probed for CVE‑2026‑59309, an authentication bypass vulnerability. Evidence shows malicious activity consistent with this flaw as early as 1 August 2026, including the creation of an administrative account named “vcenter_admin” from IP 146.59.252.178. The actor used vSphere discovery via the REST API, masquerading as legitimate VMware traffic with a User‑Agent string like “GoodMoodle‑VCFleet/1.0.” Notably, the newly created account was not leveraged in later stages of the attack, indicating that the bypass primarily served as an initial foothold or reconnaissance step.

Exploitation of CVE‑2026‑59310 – Initial Foothold
The primary intrusion vector began with a malicious cron job that wrote a malformed file called “zz‑poc59310‑syslog.log” to /etc/cron.d. This file’s name directly references the CVE identifier and mimics the vCenter remote syslog naming convention, suggesting an attempt to abuse the syslog service for privileged file placement. A subsequent curl (or wget) command fetched a backdoor from 5.34.177.38:9861, executed it, and then removed the log file to reduce traces. At least one of these cron‑delivered payloads successfully executed, deploying the “linuxFile” backdoor on the victim host.

Cron‑Based Payload Delivery and Persistence
The attacker heavily relied on cron to maintain presence and download additional tools. One cron job retrieved a shell script (“esxi.sh”) from 185.144.28.120:3232, which acted as a downloader and installer for an architecture‑specific reverse SSH binary (“reverse_ssh”) hosted on the same infrastructure. Other cron jobs created staging directories, altered file permissions, and executed payloads from servers at 192.255.141.13:8080 and 5.34.176.100:5244. Notably, the latter server inadvertently exposed its toolset via an AList directory listing, providing defenders with a potential detection vector.

To achieve persistence, the threat actor installed a systemd service that linked the “linuxFile” backdoor to a WebSocket endpoint (ws://intel.se9ly9upbhay.shop:8080/ws). Additionally, three cron jobs were crafted to impersonate legitimate VMware services:

• **vmware‑vpxd‑stats‑*** added the attacker’s SSH public key to the authorized_keys file, enabling stealthy SSH access.
• **vmware‑perf‑collect‑*** dropped a JSP web shell named “vmware‑perf‑update.jsp.”
• **vmware‑perf‑sync‑*** deployed the same web shell and executed a Base64‑encoded script that harvested credentials and created a new account (“adminuser”) added to the vSphere SSO Administrators group.

Credential Harvesting and Privilege Escalation
Beyond adding SSH keys, the actor harvested vCenter service account credentials through multiple techniques. A cron‑resident script (“/tmp/.vmware‑perf‑upd.sh”) attempted to read the Windows registry key HKEY_THIS_MACHINE\services\vmdir (when run on a Windows‑based management server) or, failing that, invoked the vmafd Python module to call GetMachineName(), GetMachinePassword(), and GetDomainName(). The extracted credentials allowed the attacker to modify the VMware Directory Service (vmdir), add the “adminuser” to the Administrators group, and further abuse privileged operations.

Another persistence mechanism involved editing /etc/sudoers.d/vmware‑perf to grant the “perfcharts” service account passwordless, unrestricted sudo access to root. This modification gave the attacker the ability to execute any command as root without prompting for a password, greatly simplifying post‑exploitation activities.

Lateral Movement and Ransomware Deployment
With root‑equivalent privileges on the vCenter Server Appliance, the attacker used the vSphere API to discover ESXi hosts and deployed the reverse SSH client via the previously downloaded “esxi.sh” script. Local accounts (e.g., “adminuser”) were created on those ESXi hosts to facilitate ransomware execution. The final stage of the intrusion involved deploying a Babuk‑derived ransomware strain that appends the .babyk extension to encrypted files. While it remains uncertain whether ransomware was the ultimate objective or merely an opportunistic payload chosen to obfuscate attribution, the encryption routine clearly demonstrates the attacker’s capacity to cause significant operational disruption.

Defense Evasion Techniques
Throughout the attack, the threat actor employed several evasion tactics:

• File naming: Malicious cron files mimicked legitimate VMware log and service names to blend with normal system activity.
• Process disguise: User‑Agent strings and REST API calls imitated bona‑fide VMware management traffic.
• Log cleanup: After executing payloads, the actor removed transient log files (e.g., the “zz‑poc59310‑syslog.log”) to reduce forensic artifacts.
• Privilege abuse: By leveraging existing administrative credentials and sudoers modifications, the actor avoided the need for traditional privilege‑escalation exploits, lowering the chance of triggering alerts tied to known vulnerability exploitation.

Conclusion and Recommendations
The exploitation of CVE‑2026‑59310 by a suspected China‑nexus APT underscores how swiftly critical vulnerabilities can be turned into effective weapons when defenders lag in patching. The multi‑stage attack—combining authentication bypass, cron‑based persistence, credential theft, and ransomware—highlights the importance of a layered defense strategy. Organizations should:

1. Apply the July 2026 patch for CVE‑2026‑59310 without delay and monitor for any unofficial exploits targeting older versions.
2. Enforce least‑privilege principles on vCenter and associated service accounts, disabling unnecessary SSH keys and restricting sudoers modifications.
3. Implement robust logging and alerting for cron jobs, systemd unit creations, and outbound connections to unfamiliar IP ranges or ports.
4. Regularly audit vSphere for unexpected administrative accounts, especially those added via LDAP or local scripts, and review sudoers files for unauthorized entries.
5. Deploy network segmentation to limit direct internet exposure of management interfaces and enforce strict egress filtering to block connections to known malicious infrastructures.

By adopting these measures, defenders can reduce the likelihood of similar intrusions and improve their ability to detect and remediate sophisticated, multi‑vector campaigns targeting virtualization platforms.