vCenter attacks exploit CVE-2026-59310 to deploy Babuk-derived ransomware
A suspected China-nexus threat actor exploited CVE-2026-59310, a critical VMware vCenter Server directory-traversal vulnerability with a CVSS score of 9.8, to gain root-level code execution and deploy Babuk-derived ransomware on ESXi hosts. German incident-response firm QUIRSO estimates the campaign compromised 361 unique victim IP addresses in 47 countries.
Broadcom released a fix for CVE-2026-59310 on July 29, 2026. QUIRSO said the activity began five calendar days after public disclosure. Germany accounted for 55 observed infections, followed by the United States with 41, Turkey with 38, Iran with 26 and France with 25.
Root execution through vCenter
The flaw can be used to execute arbitrary code on VMware vCenter Server. QUIRSO found that the attackers used a malformed cron file named zz-poc59310-syslog.log, then used curl or wget to retrieve and launch a backdoor before removing the file. The filename referenced the CVE and resembled a vCenter Server Appliance remote-syslog naming convention.
At least one cron file executed successfully and installed the linuxFile implant. The malware connects to its controller over WebSocket, receives commands, runs them through /bin/sh and returns the results. Its command-and-control address is XOR-obfuscated and decoded at runtime; it also includes persistence routines using systemd and cron.
QUIRSO said commands recorded by CROND already ran in a root context. That gave the actor unrestricted access to the underlying vCenter Server Appliance without first compromising an unprivileged local account and escalating privileges.
Persistence, identity abuse and ESXi encryption
The campaign relied heavily on cron jobs to download shell scripts and architecture-specific reverse SSH binaries. Researchers also observed jobs impersonating VMware services, including names beginning vmware-vpxd-stats-, vmware-perf-collect- and vmware-perf-sync-. These mechanisms added an attacker SSH key, dropped a JSP web shell, accessed credentials and created privileged identities.
The actor created accounts including adminuser and vcadmin, added adminuser to the vSphere SSO Administrators group, and granted the perfcharts service account unrestricted non-interactive sudo access through a sudoers configuration. It also used vSphere APIs for discovery and created local ESXi accounts to support ransomware encryption.
On one appliance, QUIRSO also found evidence consistent with exploitation of CVE-2026-59309, an authentication-bypass issue. An administrative account named vcenter_admin was created after activity seen as early as August 1, but researchers found no overlap with the CVE-2026-59310 attack chain beginning August 3 and did not see that account used later.
Ransomware may not explain the full intrusion
The final payload encrypted ESXi files with the .babyk extension, commonly associated with Babuk-derived ransomware. QUIRSO could not determine whether that payload was deployed on other affected systems because its analysis covered one compromised environment. The firm also could not establish whether ransomware was the campaign's primary objective.
Researchers assessed with moderate confidence that the operation involved a Chinese-speaking actor, citing Chinese-language script artefacts, tool use, victimology excluding mainland China and activity compatible with UTC+08:00 working hours. The campaign reinforces the risk from threats targeting virtualized infrastructure as organisations face threats that combine exposed infrastructure flaws with persistence and destructive payloads.
For businesses operating VMware environments, the practical implication is to apply Broadcom's vCenter fix promptly and investigate unexpected cron entries, systemd services, SSO administrator changes, vSphere API discovery and new ESXi local accounts for signs of compromise.