Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
A suspected China-nexus APT exploited two VMware vCenter vulnerabilities (CVE-2026-59310 and CVE-2026-59309) to compromise systems across 47 countries, with 361 unique victim IPs identified The threat actor deployed a "linuxFile" backdoor with WebSocket-based C2 communication, XOR-obfuscated addresses, and application-layer cryptography for persistence via systemd and cron Attackers impersonated legitimate VMware services through cron jobs named "vmware-vpxd-stats-*", "vmware-perf-collect-*", an
Analysis
TL;DR
- A suspected China-nexus APT exploited two VMware vCenter vulnerabilities (CVE-2026-59310 and CVE-2026-59309) to compromise systems across 47 countries, with 361 unique victim IPs identified
- The threat actor deployed a "linuxFile" backdoor with WebSocket-based C2 communication, XOR-obfuscated addresses, and application-layer cryptography for persistence via systemd and cron
- Attackers impersonated legitimate VMware services through cron jobs named "vmware-vpxd-stats-", "vmware-perf-collect-", and "vmware-perf-sync-*" to establish SSH access, deploy web shells, and create unauthorized admin accounts
- German IR firm QUIRSO attributed the campaign to a Chinese-speaking actor operating in UTC+08:00 based on Chinese-language artifacts, tooling, and victimology excluding mainland China
- The exploitation began just five days after the vulnerability's public disclosure, with attackers abusing the vCSA syslog server to place malicious files in privileged execution locations
Why It Matters
This incident demonstrates the rapid weaponization of critical infrastructure vulnerabilities, with attackers moving from disclosure to active exploitation within days—a pattern that underscores the urgency of patch management for enterprise VMware deployments. The sophisticated use of legitimate service impersonation and operational security missteps by the threat actor provides valuable indicators for defensive monitoring and threat hunting.
Technical Details
- CVE-2026-59310 (CVSS 9.8): A severe directory-traversal vulnerability in VMware vCenter Server allowing arbitrary code execution; the fix was released by Broadcom on July 29, 2026
- CVE-2026-59309: An authentication bypass vulnerability that was actively scanned and exploited as early as August 1, 2026, leading to the creation of a "vcenter_admin" account via REST API with spoofed User-Agent "GoodMoodle-VCFleet/1.0"
- linuxFile implant: A backdoor establishing WebSocket C2 connections (ws://intel.se9ly9upbhay.shop:8080/ws) with XOR-obfuscated C2 addresses decoded at runtime, application-layer cryptography over unencrypted transport, automatic reconnection, and persistence via systemd and cron
- Cron-based attack chain: Attackers abused the vCSA syslog server to place malformed cron files in /etc/cron.d/, deploying shell scripts ("esxi.sh") that downloaded architecture-specific reverse SSH binaries and JSP web shells while impersonating legitimate VMware service names
- Operational security blunder: The threat actor's infrastructure at "5.34.176[.]100:5244" exposed reverse SSH binaries via an AList directory listing, providing forensic artifacts for attribution
Industry Insight
- Organizations running VMware vCenter should prioritize immediate patching of CVE-2026-59310 and CVE-2026-59309, and audit for unauthorized cron jobs, systemd services, and SSH authorized_keys entries that may indicate prior compromise
- The rapid exploitation timeline (5 days post-disclosure) reinforces the need for vulnerability management programs that can patch critical flaws within days, not weeks, especially for internet-facing infrastructure
- Defensive monitoring should focus on anomalous syslog file placements in /etc/cron.d/, unusual WebSocket connections from vCenter appliances, and cron jobs impersonating VMware service names as key indicators of this campaign
Disclaimer: The above content is generated by AI and is for reference only.