China-Nexus APT Exploits VMware vCenter Flaw at Scale, Deploys Ransomware
A suspected China-nexus advanced persistent threat is actively exploiting CVE-2026-59310, a critical directory-traversal vulnerability in Broadcom VMware vCenter Server (CVSS 9.8), to gain unauthenticated remote code execution with root privileges on vCenter Server Appliances. German incident response firm QUIRSO, which uncovered the campaign, assesses with moderate confidence that the actor operates from the UTC+08:00 time zone based on Chinese-language artifacts in attacker scripts, reuse of Chinese security research, and victimology that excludes mainland China.
The campaign has compromised at least 361 unique victim IP addresses across 47 countries. The heaviest concentrations are in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). European organisations are prominently represented.
Attack Chain
Exploitation begins five days after Broadcom's July 29 patch release. The actor abuses vCenter's syslog service to write a malformed cron job file to /etc/cron.d, achieving immediate root-level code execution without any privilege escalation step. From there, the campaign follows a methodical progression:
- A cron-deployed backdoor ("linuxFile") connects to C2 over WebSocket (ws://intel.se9ly9upbhay.shop:8080/ws) with XOR-obfuscated addressing and custom application-layer cryptography. Persistence is established via systemd and cron. - Three cronjobs impersonating legitimate VMware services (vmware-vpxd-stats, vmware-perf-collect, vmware-perf-sync) add attacker SSH keys, drop a JSP web shell (vmware-perf-update.jsp), and run Base64-encoded scripts that harvest vmdir credentials and create a vSphere SSO Administrator account ("adminuser"). - A sudoers entry grants the "perfcharts" service account unrestricted passwordless root access. - A reverse SSH binary is deployed to ESXi hosts via an "esxi.sh" downloader, with infrastructure at 185.144.28[.]120:3232. - Local "adminuser" accounts are created on ESXi hosts, enabling ransomware deployment.
The ransomware encrypts files with the ".babyk" extension, consistent with Babuk-derived ransomware. QUIRSO suspects the ransomware may be a smokescreen designed to destroy forensic evidence (particularly ESXi log files) rather than the primary objective of the campaign.
Attribution and Infrastructure
In a follow-up analysis, QUIRSO identified a GitHub repository (pikpak0066/tmpclean, created August 14) linked to the same threat actor. The repository masquerades as a /tmp cleaning daemon for Linux but reverse engineering confirmed the published binaries are the actor's reverse SSH builds. Additional infrastructure includes 146.59.252[.]178 (used for CVE-2026-59309 authentication bypass exploitation and vSphere REST API discovery), 5.34.177[.]38:9861 (backdoor distribution), and 192.255.141[.]13:8080.
The campaign also exploits CVE-2026-59309, a separate vCenter authentication bypass, on the same systems. No overlap was observed between the two exploitation chains, suggesting either parallel actors or a sophisticated multi-vector approach.
So What / Action
This is not a scanning campaign — it is a structured, multi-stage intrusion operation with credential theft, lateral movement, and ransomware deployment by an actor with nation-state tradecraft. If you run VMware vCenter and have not patched since July 29, assume compromise. Immediate priorities:
1. Patch vCenter immediately — CVE-2026-59310 (VMSA-2026-0012) and CVE-2026-59309. Both are under active exploitation. CISA's remediation deadline was August 21. 2. Hunt for IOCs — Check /etc/cron.d/ for files named with "poc59310" or "vmware-perf-" prefixes. Look for the "vcenter_admin" and "adminuser" accounts. Search /etc/sudoers.d/ for "vmware-perf". Audit authorized_keys files for attacker SSH keys. 3. Inspect vSphere SSO — Review Administrator group membership for unauthorised accounts, particularly any created via vmdir LDAP operations from external IPs. 4. Block C2 infrastructure — Add the identified IPs and domains to network blocklists. 5. Assume lateral movement — If vCenter was compromised, treat all managed ESXi hosts and guest VMs as potentially affected until forensic review completes.
European CISOs should treat this as a live, ongoing campaign. The 361 compromised IPs likely represent a fraction of total impact.