Chinese APT Group Exploits VMware vCenter Flaw and Deploys Babuk-Based Ransomware

Researchers at the German incident-response firm QUIRSO have linked the active exploitation of a recently patched vulnerability in Broadcom VMware vCenter to a suspected Chinese APT group. At issue is CVE-2026-59310 (CVSS 9.8) — a critical directory-traversal flaw that allows arbitrary code execution. Broadcom released a patch on July 29, 2026, and the attacks began just five days after the details were publicly disclosed.

Scale and attribution

By QUIRSO's estimate, the campaign compromised 361 unique IP addresses across 47 countries. The most affected were Germany (55), the United States (41), Turkey (38), Iran (26) and France (25). Analysts draw the conclusion of a Chinese trail with moderate confidence: they point to Chinese-language artifacts in the attackers' scripts, borrowed material from a Chinese trade publication, the use of Chinese software, the profile of the victims (mainland China was excluded) and a working schedule that fits the UTC+08:00 time zone.

How the attack works

On one of the analyzed servers, researchers found traces of two vulnerabilities at once — CVE-2026-59310 and the authentication bypass CVE-2026-59309. Exploiting the first gave the attackers immediate code execution with root privileges directly on the vCenter Server Appliance, without any need to hijack an unprivileged account and escalate privileges.

One detail is telling: by abusing the syslog service, the attackers dropped a file with the tellingly named zz-poc59310-syslog.log into the /etc/cron.d directory, where cron would then execute it. Via curl or wget, they downloaded the linuxFile backdoor — an implant offering remote command execution through /bin/sh, with an XOR-obfuscated C2 address and its own application-layer cryptography layered over the cleartext ws:// channel. Next came reverse SSH, a JSP web shell and a whole collection of cron jobs masquerading as legitimate VMware services such as vmware-perf-collect. The attackers created administrative accounts, added their own SSH keys, stole vmdir directory credentials and configured passwordless sudo.

Ransomware as a smokescreen

The end of the chain is the deployment on ESXi hosts of ransomware that appends the .babyk extension to files, which is usually associated with Babuk derivatives. The researchers doubt, however, that extortion was the main goal. According to Denis Shadkowski, the encryption looks like a diversionary maneuver: it destroys the ESXi logs and deprives defenders of the telemetry that would help them make sense of the attackers' actions. It is possible that the familiar Babuk strain was chosen deliberately — to muddle attribution. The analysis so far has covered only a single infected system, so the extent to which the locker itself was used remains unclear.

Source: The Hacker News