China-Nexus APT Exploits VMware vCenter Flaw at Scale — 361 Victims, Ransomware Deployed
A suspected China-nexus advanced persistent threat has rapidly weaponised CVE-2026-59310, a critical (CVSS 9.8) path traversal vulnerability in the VMware vCenter Syslog server, compromising at least 361 unique IP addresses across 47 countries within five days of public disclosure. German incident response firm QUIRSO assessed with moderate confidence that the actor operates from the UTC+8 timezone, citing Chinese-language artefacts in attack scripts, reuse of Chinese security research, and systematic exclusion of mainland China from victimology.
The attack chain starts with an unauthenticated network request to the vCenter Syslog service, which writes a malformed cron file to `/etc/cron.d`. This grants immediate root-level code execution on the vCenter Server Appliance without requiring prior authentication or local privilege escalation. From there, the actor:
- Deployed a WebSocket-based backdoor ("linuxFile") connecting to `ws://intel.se9ly9upbhay.shop:8080/ws` with XOR-obfuscated C2 addresses and application-layer encryption - Established persistence through systemd services and cron jobs disguised as legitimate VMware processes (`vmware-vpxd-stats-`, `vmware-perf-collect-`, `vmware-perf-sync-*`) - Dropped a JSP web shell (`vmware-perf-update.jsp`) for alternative access - Created multiple administrative accounts on vCenter and vSphere SSO, including through LDAP manipulation of the VMware Directory Service (vmdir) - Stole vCenter machine credentials via the `vmafd` Python module and `/etc/sudoers.d/vmware-perf` for passwordless root sudo - Deployed `reverse_ssh` binaries for persistent remote access across ESXi hosts - In at least one case, deployed Babuk-derived ransomware encrypting ESXi files with the `.babyk` extension — potentially as a smokescreen to destroy forensic evidence rather than as the primary campaign objective
Europe is heavily represented in the victim distribution: Germany (55 IPs), France (25), alongside the US (41), Turkey (38), and Iran (26). The breadth of compromise across 47 countries and the speed of exploitation — first observed August 3, just five days after the July 29 patch release — indicates a pre-positioned capability or rapid weaponisation pipeline.
Separately, CVE-2026-33824 (CVSS 9.8), a double-free vulnerability in Microsoft's IKE Service Extensions, has been added to CISA's KEV catalog with confirmed active exploitation. Unit 42 reports a different Chinese-speaking threat actor exploiting this flaw while simultaneously running an autonomous, AI-driven hacking campaign using DeepSeek. This represents one of the first documented cases of a nation-state-affiliated actor deploying large-language-model-powered autonomous attack infrastructure alongside manual exploitation.
Three further KEV additions carry the same August 21 BOD 26-04 remediation deadline: CVE-2026-65400 (macOS Screen Sharing authentication bypass, CVSS 9.8, actively exploited for Monero mining), CVE-2026-55040 (SharePoint authentication bypass, CVSS 9.1, PoC-available exploitation), and CVE-2026-59309 (VMware vCenter authentication bypass, chained with CVE-2026-59310 in observed attacks).
So What / Action
If you run VMware vCenter and haven't patched since July 29, assume compromise. The attack chain provides full root access from a single unauthenticated request — there is no lateral movement required, no privilege escalation needed. Patch immediately; if patching isn't possible today, isolate vCenter from all untrusted network access and audit for the IOC patterns QUIRSO has published (cron files matching `zz-poc59310-`, accounts named `vcenter_admin`/`vcadmin`/`adminuser`, sudoers entries in `/etc/sudoers.d/vmware-perf`). For IKE VPN infrastructure, the CVE-2026-33824 patch is equally urgent given the AI-augmented exploitation campaign — this is no longer theoretical. The three-day BOD 26-04 deadline (August 21) exists because these are being exploited at speed and scale.
Jonathan Care has 33 years in cybersecurity and fraud detection. These are his personal views, not those of his employer.