China-Nexus APT Exploits VMware vCenter Flaws to Deploy Babuk-Derived Ransomware

Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code. A fix for the flaw was released by Broadcom on July 29, 2026.

German incident response company QUIRSO assessed with moderate confidence that the exploitation campaign aimed at CVE-2026-59310 is operated by a Chinese-speaking threat actor, likely working in the UTC+08:00 time zone, which is predominantly used in Chinese-speaking regions. The assessment is based on the convergence of Chinese-language artifacts in attacker-created scripts, apparent reuse of research from a Chinese security publication, repeated operational use of Chinese-language tools and management software, victimology excluding mainland China, and activity patterns compatible with UTC+08:00 working hours.

The activity, which commenced five calendar days after public disclosure of the flaw, is estimated to have compromised 361 unique victim IP addresses across 47 countries, with most of the infections scattered across Germany (55), the U.S. (41), Turkey (38), Iran (26), and France (25).

One compromised vCenter Server Appliance analyzed by QUIRSO is said to have been targeted by both CVE-2026-59310 and CVE-2026-59309, an authentication bypass that has also witnessed active scanning efforts. Evidence shows malicious activity consistent with the exploitation of CVE-2026-59309 as early as August 1, 2026, followed by the creation of an administrative account on vCenter. The account creation originated from the IP address 146.59.252[.]178 and also involved vSphere discovery via the REST API on August 3 using User-Agent strings like “GoodMoodle-VCFleet/1.0,” in an attempt to masquerade it as VMware-related activity.

As for the exploitation of CVE-2026-59310, the first activity involved the cron daemon logging a malformed cron file called “zz-poc59310-syslog.log.” In the next step, a curl command (or alternatively a wget command) is executed to retrieve a backdoor from “5.34.177[.]38:9861” and execute it, and then remove the log file. The threat actor also relied extensively on cron to execute malicious payloads, including to fetch and run a shell script (“esxi.sh”) from the IP address “185.144.28[.]120:3232.” The shell script then serves as a downloader and persistence installer for an architecture-specific reverse SSH (“reverse_ssh”) binary that’s retrieved from the same infrastructure.

The attack ultimately paves the way for the deployment of a ransomware on ESXi hosts that encrypts files with the “.babyk” extension, which is typically associated with Babuk-derived ransomware. It’s not clear if this was the end goal of the campaign, or if the Babuk-derived payload was “selected opportunistically or even intentionally” to confuse attribution efforts.