VMware vCenter CVE-2026-59310
Cybersecurity researchers have linked the exploitation of a recently patched VMware vCenter vulnerability to a suspected Chinese state-sponsored hacking group. The attacks have already hit hundreds of organizations across nearly 50 countries.
The flaw, tracked as CVE-2026-59310, is about as bad as it gets. It's a directory-traversal vulnerability with a CVSS score of 9.8, meaning it allows attackers to execute code on vulnerable vCenter servers without needing any special privileges. Broadcom released a patch on July 29, 2026, but by then, attackers were already moving.
German incident response company QUIRSO led the investigation. They assessed with moderate confidence that the campaign is the work of a Chinese-speaking threat actor, likely operating in the UTC+08:00 time zone. This is not just an assumption. There is an evidence that includes the presence of artifacts in the attackers' scripts related to Chinese language, the use of research from Chinese security periodicals, and matching working hours.
Let me walk you through the VMware vCenter CVE-2026-59310 China-nexus APT campaign, how it unfolded, and what you need to do to protect your organization.
Campaign Highlights
- CVE-2026-59310 is a critical directory traversal vulnerability
- CVSS score: 9.8 (Critical)
- Associated with a China nexus APT group with moderate certainty
- Total of 361 victims with IPs located in 47 countries
- Campaign started only 5 days after disclosure of the exploit
- Attackers used linuxFile backdoor and reverse_ssh
- Babuk-derived ransomware was used as a smokescreen
The Attribution Evidence
The VMware vCenter CVE-2026-59310 China-nexus APT attribution isn't based on a single clue. It is the conclusion drawn from various evidences that together form a definite picture.
Artifacts Written in Chinese:
The attackers used scripts that had Chinese languageelements in them. Now this alone does not prove anything because anyone could have written these Chinese language comments. But it's a consistent pattern across multiple files.
Research Reuse:
The attackers seemed to reuse research from a Chinese security publication. This implies that the attackers belong to the Chinese-language cybersecurity community, be it state sponsored or not.
Working Hours:
These activities can fit into UTC+08:00 working hours. These working hours belong to the China, Taiwan, Singapore, and the Southeast Asia area. The attackers were not working on a round-the-clock basis but were working during normal working hours.
Victimology:
Perhaps the most telling piece of evidence is that the targets explicitly excluded mainland China. Chinese-speaking threat actors, especially state-sponsored ones, typically avoid targeting domestic organizations. This pattern is consistent with past Chinese APT operations.
QUIRSO researchers Maike Orlikowski, Çağatay Yürekli, and Denis Szadkowski led the investigation.
The Scale of the Campaign
The VMware vCenter CVE-2026-59310 China-nexus APT campaign is remarkably widespread.
Victims:
- 361 unique victim IP addresses
- Spread across 47 countries
Top Affected Countries:
- Germany: 55 victims
- United States: 41 victims
- Turkey: 38 victims
- Iran: 26 victims
- France: 25 victims
Timeline:
- July 29: Broadcom released the patch
- August 3: Exploitation began
- That's just five days after public disclosure
Attackers were ready to go almost immediately. They had either reverse-engineered the patch or had already developed their own exploit independently.
Exploitation of CVE-2026-59309
The investigation found that one compromised vCenter Server Appliance was targeted by two different vulnerabilities: CVE-2026-59310 and CVE-2026-59309.
CVE-2026-59309:
This is an authentication bypass vulnerability that also saw active scanning efforts. Detecting the vulnerability had been going on since August 1, 2026.
Creation of Administrative Account:
The attackers managed to create a new account called “vcenter_admin.” And this is where it gets exciting; there were no login attempts for the valid administrative account that created this account. The new account was created from the IP 146.59.252[.]178.
Attemps at Masquerade:
The attackers attempted masquerade through user-agent strings such as "GoodMoodle-VCFleet/1.0". These attempts were meant to masquerade the attacks as normal behavior associated with VMware.
Key Finding:
The two types of activities are completely unrelated since there is no commonality between CVE-2026-59309 and CVE-2026-59310 exploits. The "vcenter_admin" credential was not used further on in the campaign. This suggests two separate teams or phases of the operation.
Exploitation of CVE-2026-59310
The VMware vCenter CVE-2026-59310 China-nexus APT campaign followed a clear sequence of steps.
Step 1: The Cron File
The first indication of suspicious behavior was the existence of a malformed cron file. The name of this file was “zz-poc59310-syslog.log.” The name is an exact match for the CVE number and denotes the development of a proof-of-concept exploit following disclosure of the vulnerability.
The file was present under the directory /etc/cron.d and not at the destination for syslog. This implies that the attackers used the vCSA syslog server to put files into a privileged execution location.
Step 2: Backdoor Download
A curl or wget command was used to download a backdoor from “5.34.177[.]38:9861.” This backdoor was subsequently executed and the log file deleted to hide evidence.
Step 3: Persistence
At least one file that successfully executed and installed the “linuxFile” backdoor. The attackers now had persistent remote access.
The linuxFile Backdoor
The VMware vCenter CVE-2026-59310 China-nexus APT campaign used a custom backdoor called linuxFile.
Capabilities:
- Allows for remote command execution
- Establishes connection to its controller via WebSocket
- Gets instructions from the attacker
- Runs them using /bin/sh
- Sends outputs back to the attacker
Technical Details:
- The C2 address is XOR-obfuscated and decoded at run-time
- Communications use application-layer cryptography
- Despite using unencrypted ws:// transport
- Automatically reconnects on failure
- Establishes persistence through systemd and cron
This is professional-grade malware. They spent considerable efforts in ensuring that it was strong and difficult to detect.
The Reverse_ssh Deployment
The attackers relied heavily on cron to execute malicious payloads.
The esxi.sh Script:
- Fetched and ran from IP "185.144.28[.]120:3232"
- Served as a downloader and persistence installer
- Retrieved architecture-specific reverse_ssh binary
Other Cron Jobs:
- Created staging directories
- Downloaded executables
- Changed permissions
- Ran executables
Exposed Infrastructure:
Servers at "192.255.141[.]13:8080" and "5.34.176[.]100:5244." The latter revealed reverse SSH binaries using an AList directory listing. This was an operational security blunder by the attackers.
Attack Actions Overview
In the VMware vCenter CVE-2026-59310 China-nexus APT attack campaign, there were many actions conducted together.
1. Deployment of linuxFile:
This backdoor had the connection to "ws://intel.se9ly9upbhay.shop:8080/ws" and established persistence via a systemd service.
2. Impersonation of VMware Services using Cronjobs:
The attackers have deployed three cronjobs which act as an impersonation of VMware services as follows:
- vmware-vpxd-stats-*: SSH public key
- vmware-perf-collect-*: Webshell through JSP
- vmware-perf-sync-*: Webshell with creation of "adminuser" account
3. More Accounts Used:
The attackers created two more accounts:
- "vcadmin" created through vSphere with Base64 encoded Python script
- vSphere admin account through external LDAP using an admin’s compromised account
4. Root Privileges via sudo:
The attacker will be able to create “/etc/sudoers.d/vmware-perf”. This will give the perfchart service account root privileges to execute commands.
5. Credentials Harvesting:
This is achieved by running “/tmp/.vmware-perf-upd.sh". The registry was also searched for the credentials along with the VMware vmafd Python module. These credentials were used to modify the directories.
6. ESXi Hosts:
Local accounts were created on ESXi hosts to allow the ransomware encryption process.
The Ransomware Smokescreen
The VMware vCenter CVE-2026-59310 China-nexus APT campaign deployed Babuk-derived ransomware.
The Payload:
- Encrypts files with the ".babyk" extension
- Typically associated with Babuk ransomware
The Purpose:
Here's where it gets interesting. QUIRSO suspects the ransomware wasn't the primary objective. It was all a smokescreen.
Why Ransomware?
- It diverts the defenders from the actual attack
- Encryption of the ESXi logs makes the telemetry data inaccessible
- This obstructs analysis and covers up the attackers’ tracks
QUIRSO's Assessment:
"Exploitation of CVE-2026-59310 provided the actor with immediate, non-interactive code execution in a root context on the vCenter Server appliance. Subsequent commands recorded by CROND were therefore already being executed as root, giving the actor unrestricted access to the underlying VCSA without first having to compromise an unprivileged local account and escalate from it."
The attackers had root access from the very beginning.No privilege escalation was needed because they had already accomplished that, thus making things much simpler for them.
What Organizations Need to Do
VMware vCenter CVE-2026-59310 China-nexus APT attack needs to be addressed urgently.
Urgent Actions:
- Apply the patch by Broadcom for CVE-2026-59310 urgently
- Apply the patch for CVE-2026-59309
- Patches were released on July 29, 2026
Detection:
- Check for malformed cron files
- Look for "zz-poc59310-syslog.log"
- Monitor for unusual cron jobs
- Check for the linuxFile backdoor
- Look for reverse_ssh binaries
- Review sudoers.d for unauthorized entries
Response:
- Investigate unauthorized admin accounts
- Check for "vcenter_admin," "adminuser," "vcadmin"
- Review ESXi host accounts
- Look for ".babyk" encrypted files
Wrapping It Up
The VMware vCenter CVE-2026-59310 China-nexus APT campaign is a serious threat. The threat actor speaking in Chinese has targeted 361 unique victim IP addresses in 47 different countries.
Important facts to note:
- The CVE-2026-59310 is a highly rated vulnerability.
- Score: 9.8 on CVSS scale.
- Linked to China-related APT group with moderate confidence.
- 361 victims in 47 countries.
- Deployment of linuxFile backdoor and reverse_ssh.
- Babuk ransomware used as smokescreen.
- Full root access instantly.
Organizations should apply Broadcom's patches immediately. Monitor for indicators of compromise. Look for any accounts that may not be authorized.
The VMware vCenter CVE-2026-59310 China-nexus APT attack is an example of how the threat posed by nation-state attackers remains constant.
FAQ Section
What is CVE-2026-59310?
It is a critical directory-traversal vulnerability in VMware vCenter Server. It allows attackers to execute arbitrary code on vulnerable systems. The CVSS score is 9.8.
Who is behind the exploitation?
QUIRSO assessed with moderate confidence that the campaign is operated by a Chinese-speaking threat actor, likely working in the UTC+08:00 time zone.
How many victims are there?
The campaign has compromised 361 unique victim IP addresses across 47 countries.
What malware is being deployed?
Attackers are deploying the linuxFile backdoor and reverse_ssh. They also deploy Babuk ransomware as smokescreen.
What should be done by organizations?
Patching from Broadcom must be carried out. Malformed cron files and rogue administrative access must be looked for. Check for ".babyk" encrypted files.
