Suspected China Nexus APT Exploits VMware vCenter Flaw to Deploy Ransomware

Cybersecurity researchers have linked the exploitation of a newly patched VMware vCenter vulnerability to a suspected China nexus advanced persistent threat.

The campaign targets CVE 2026 59310, a critical directory traversal vulnerability in VMware vCenter Server with a CVSS score of 9.8. The flaw can allow attackers to execute arbitrary code with root privileges. Broadcom released a security update for the vulnerability on July 29, 2026.

German incident response company QUIRSO assessed with moderate confidence that the campaign is being conducted by a Chinese speaking threat actor, likely operating in the UTC+08:00 time zone.

The assessment is based on Chinese language artifacts found in attacker scripts, the use of Chinese language tools, apparent reuse of research published by a Chinese security source, victim targeting patterns, and activity occurring during working hours commonly associated with the UTC+08:00 time zone.

361 Victim IP Addresses Identified

The exploitation campaign began approximately five days after public disclosure of the vulnerability.

Researchers estimate that attackers compromised 361 unique victim IP addresses across 47 countries.

The countries with the highest number of identified victims include:

  • Germany: 55
  • United States: 41
  • Turkey: 38
  • Iran: 26
  • France: 25

CVE 2026 59309 Also Exploited

QUIRSO also observed evidence of exploitation involving CVE 2026 59309, an authentication bypass vulnerability affecting VMware vCenter.

On one compromised vCenter Server Appliance, attackers appeared to exploit CVE 2026 59309 before creating a new administrative account.

The activity included vSphere discovery through the REST API and the use of a User Agent string designed to resemble legitimate VMware infrastructure.

However, researchers found no evidence that the newly created vcenter_admin account was used during the later stages involving CVE 2026 59310.

Exploitation of CVE 2026 59310

The attack involving CVE 2026 59310 began with the creation of a malformed cron file named zz-poc59310-syslog.log.

Attackers then used curl or wget to download a backdoor from an external server and execute it before deleting the file.

The file name appears to reference the CVE and the publicly available proof of concept released after the vulnerability became known.

Researchers believe the attackers abused the vCenter syslog functionality to place files inside /etc/cron.d, allowing malicious commands to execute with root privileges.

LinuxFile Backdoor

One of the main implants used in the attack is a backdoor called linuxFile, also known as systemlog or linux_x86.

The malware provides remote command execution and communicates with its command and control server through a WebSocket connection.

It can execute commands using /bin/sh, return command results to the attacker, automatically reconnect after communication failures, and establish persistence through systemd and cron.

The C2 address is obfuscated and decoded during execution. The malware also uses application layer encryption to protect its communications.

Extensive Persistence and Credential Theft

The attackers heavily abused cron jobs to maintain access and deploy additional tools.

Their activity included:

  • Deploying the linuxFile backdoor
  • Creating malicious cron jobs that imitate VMware services
  • Adding attacker SSH keys for remote access
  • Deploying JSP web shells
  • Creating unauthorized vSphere administrator accounts
  • Adding malicious accounts to the vSphere SSO Administrators group
  • Creating passwordless root sudo access for the perfcharts service account
  • Extracting vCenter machine credentials
  • Modifying VMware directory services
  • Performing vSphere and ESXi reconnaissance
  • Deploying reverse SSH connections
  • Creating accounts on ESXi hosts
  • Attempting to evade detection and remove forensic evidence

The attackers also used scripts to retrieve credentials associated with VMware Directory Service and used those credentials to make privileged directory modifications.

Ransomware Deployment

The campaign ultimately resulted in ransomware being deployed against ESXi hosts.

The ransomware encrypted files using the .babyk extension, which is commonly associated with ransomware derived from the leaked Babuk source code.

Researchers have not determined whether ransomware deployment was the primary objective of the operation.

QUIRSO also suggested that the ransomware may have been used as a distraction. Encrypting ESXi logs could prevent defenders from accessing important telemetry and make forensic investigation more difficult.

Why the Vulnerability Is Critical

CVE 2026 59310 provides attackers with immediate, non interactive code execution in a root context on the vCenter Server Appliance.

This means attackers do not need to first compromise a low privilege account and perform a separate privilege escalation step. Once exploitation succeeds, the attacker can directly execute commands with root level access to the underlying vCenter appliance.

Organizations running VMware vCenter should prioritize applying Broadcom's security updates, investigate suspicious cron activity, review newly created administrator accounts, monitor unexpected SSH activity, and check ESXi hosts for unauthorized accounts, web shells, reverse SSH connections, and ransomware activity.