China-Nexus APT Exploits VMware vCenter Vulnerability to Deploy Ransomware

Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom's VMware vCenter to a suspected advanced persistent threat (APT) linked to China. The attacks involve the exploitation of CVE-2026-59310, a severe directory-traversal vulnerability in the VMware vCenter server that could allow malicious actors to execute arbitrary code. A fix for this flaw was released by Broadcom on July 29, 2026.

German incident response company QUIRSO assessed with moderate confidence that the exploitation campaign targeting CVE-2026-59310 is operated by a Chinese-speaking threat actor, likely based in the UTC+08:00 time zone, which is predominantly used in Chinese-speaking regions. This assessment is based on various factors, including the presence of Chinese-language artifacts in attacker-created scripts and the reuse of research from a Chinese security publication.

The activity began five days after the public disclosure of the flaw and is estimated to have compromised 361 unique victim IP addresses across 47 countries, with the highest number of infections reported in Germany, the United States, Turkey, Iran, and France.

One compromised vCenter Server Appliance analyzed by QUIRSO was targeted by both CVE-2026-59310 and CVE-2026-59309, an authentication bypass vulnerability. Evidence suggests that malicious activity consistent with the exploitation of CVE-2026-59309 began as early as August 1, 2026, followed by the creation of an administrative account on vCenter. However, no login events have been recorded for this legitimate administrative account.

The exploitation of CVE-2026-59310 involved the cron daemon logging a malformed cron file named "zz-poc59310-syslog.log." Subsequently, a curl command was executed to retrieve a backdoor from a specified IP address and execute it. The naming convention of the log file is significant as it references the CVE identifier and indicates it was a proof-of-concept devised after the flaw's public disclosure.

The linuxFile implant established a connection to its controller over a WebSocket channel, allowing the attacker to execute commands remotely. The command-and-control address is XOR-obfuscated and decoded at runtime, with communications protected by the malware's application-layer cryptography.

The threat actor extensively used cron to execute malicious payloads, including fetching and running a shell script that served as a downloader for a reverse SSH binary. The attack ultimately led to the deployment of ransomware on ESXi hosts, encrypting files with the .babyk extension, typically associated with Babuk-derived ransomware. However, it remains unclear whether this was the primary goal of the campaign or a distraction to confuse attribution efforts.

QUIRSO noted that the deployment of the ransomware may not have been the main objective, as the analysis was limited to a single infected system. The exploitation of CVE-2026-59310 provided the actor with immediate, non-interactive code execution in a root context on the vCenter Server appliance, granting unrestricted access without needing to compromise an unprivileged local account first.