Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
German incident response firm QUIRSOS assessed with moderate confidence that a suspected China-nexus actor, likely operating in UTC+08:00 hours, exploited VMware vCenter flaw CVE-2026-59310 (CVSS 9.8 directory traversal) beginning five days after Broadcom's July 29 patch. The campaign compromised 361 unique victim IPs across 47 countries, most in Germany, the US, Turkey, Iran, and France. The actor abused cron jobs, a XOR-obfuscated 'linuxFile' WebSocket backdoor with systemd/cron persistence, a JSP web shell, SSH authorized-keys manipulation, and a reverse SSH tool, with one Babuk deployment reported. A separate vCenter 'vcenter_admin' account creation consistent with CVE-2026-59309 exploitation was also observed from August 1.
- 361 unique victim IPs across 47 countries; Germany and US most affected
- linuxFile backdoor uses WebSocket C2 with XOR-obfuscated address and app-layer crypto
- Cron jobs impersonated VMware services to install web shells and reverse SSH
- Actor's AList server exposed reverse SSH binaries in an opsec blunder
- Separate CVE-2026-59309 authentication bypass activity seen from August 1
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1053.003 CronT1505.003 Web ShellT1098.004 SSH Authorized KeysT1136.001 Local Account
- Products
- VMware vCenter
- Threat actors
- China-nexus threat actorBabuk
- Malware
- linuxFile
- Organizations
- QUIRSO
- Countries
- GermanyUnited StatesTurkeyIranFrance
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service | 9.8 | 8% | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
7 min read at thehackernews.com
Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9. 8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.