Chinese APT Exploits Critical VMware vCenter Flaws in Global Cyber Campaign
Cybersecurity researchers have linked a series of attacks targeting a recently patched Broadcom VMware vCenter vulnerability to a China-nexus advanced persistent threat (APT) group. The campaign exploits CVE-2026-59310 (CVSS 9.8), a severe directory-traversal flaw allowing arbitrary code execution, alongside CVE-2026-59309, an authentication bypass vulnerability.
The attacks began five days after Broadcom released patches on July 29, 2026, with 361 unique victim IP addresses compromised across 47 countries, including Germany (55), the U.S. (41), Turkey (38), Iran (26), and France (25). German incident response firm QUIRSO attributed the activity to a Chinese-speaking threat actor, citing:
- Chinese-language artifacts in attacker scripts
- Reuse of research from a Chinese security publication
- Operational use of Chinese-language tools
- Victimology excluding mainland China
- Activity aligned with UTC+08:00 working hours
Exploitation Tactics
The threat actor leveraged CVE-2026-59310 to gain root-level access on vCenter Server Appliances (VCSA), deploying a backdoor ("linuxFile") via cron jobs. Key actions included:
- Abusing cron to execute malicious payloads, including a reverse SSH binary for persistence
- Creating rogue admin accounts ("vcenter_admin," "vcadmin," "adminuser") via vSphere SSO and LDAP manipulation
- Granting passwordless sudo access to the "perfcharts" service account
- Deploying a JSP web shell ("vmware-perf-update.jsp") for credential theft
- Exfiltrating vCenter machine credentials via registry queries and Python scripts
- Encrypting ESXi hosts with Babuk-derived ransomware (".babyk" extension)
Operational Security Failures
The attackers exposed their reverse SSH toolset via an AList directory listing on 5.34.176[.]100:5244, a rare misstep in an otherwise stealthy campaign. They also masqueraded as VMware tools, using User-Agent strings like "GoodMoodle-VCFleet/1.0" to blend in.
Impact & Attribution
While the end goal remains unclear whether ransomware was the primary objective or a diversion researchers note the Babuk payload may have been used to obscure attribution. The campaign highlights the rapid weaponization of VMware flaws by state-aligned actors, with root-level access achieved within days of patch release.
QUIRSO’s findings underscore the criticality of timely patching and monitoring for post-exploitation activity, particularly in virtualized environments.
Source: https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html
Broadcom TPRM report: https://www.rankiteo.com/company/vmware
"id": "vmw1786955033",
"linkid": "vmware",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '361 unique victim IP addresses',
'location': ['Germany',
'U.S.',
'Turkey',
'Iran',
'France',
'42 other countries'],
'type': 'Organizations using VMware vCenter'}],
'attack_vector': ['Exploitation of Unpatched Vulnerability',
'Directory-Traversal Flaw',
'Authentication Bypass'],
'data_breach': {'data_encryption': 'Yes (ESXi hosts encrypted with '
'Babuk-derived ransomware)',
'data_exfiltration': 'Yes (vCenter machine credentials via '
'registry queries and Python scripts)',
'sensitivity_of_data': 'High (vCenter machine credentials, '
'potentially other sensitive data)',
'type_of_data_compromised': ['Credentials',
'Personally Identifiable '
'Information (PII)']},
'description': 'Cybersecurity researchers have linked a series of attacks '
'targeting a recently patched Broadcom VMware vCenter '
'vulnerability to a China-nexus advanced persistent threat '
'(APT) group. The campaign exploits CVE-2026-59310 (CVSS 9.8), '
'a severe directory-traversal flaw allowing arbitrary code '
'execution, alongside CVE-2026-59309, an authentication bypass '
'vulnerability. The attacks began five days after Broadcom '
'released patches on July 29, 2026, with 361 unique victim IP '
'addresses compromised across 47 countries.',
'impact': {'data_compromised': 'vCenter machine credentials, potentially '
'other sensitive data',
'operational_impact': 'Root-level access achieved, rogue admin '
'accounts created, systems encrypted with '
'ransomware',
'systems_affected': ['VMware vCenter Server Appliances (VCSA)',
'ESXi hosts']},
'initial_access_broker': {'backdoors_established': 'Yes (reverse SSH binary, '
'cron jobs, rogue admin '
'accounts)',
'entry_point': 'Exploitation of CVE-2026-59310 and '
'CVE-2026-59309'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Criticality of timely patching and monitoring for '
'post-exploitation activity in virtualized environments.',
'post_incident_analysis': {'corrective_actions': ['Apply patches immediately',
'Monitor for cron job abuse '
'and rogue admin accounts',
'Enhance detection of '
'reverse SSH and unusual '
'User-Agent strings'],
'root_causes': ['Unpatched VMware vCenter '
'vulnerabilities (CVE-2026-59310, '
'CVE-2026-59309)',
'Lack of timely patching',
'Insufficient monitoring for '
'post-exploitation activity']},
'ransomware': {'data_encryption': 'Yes (ESXi hosts)',
'data_exfiltration': 'Yes (vCenter machine credentials)',
'ransomware_strain': "Babuk-derived ('.babyk' extension)"},
'recommendations': ['Apply VMware vCenter patches immediately',
'Monitor for post-exploitation activity',
'Review and secure cron jobs and admin accounts',
'Enhance monitoring for unusual User-Agent strings and '
'reverse SSH activity'],
'references': [{'source': 'QUIRSO'},
{'source': 'Chinese security publication (research reused by '
'threat actor)'}],
'response': {'third_party_assistance': 'QUIRSO (German incident response '
'firm)'},
'threat_actor': 'China-nexus APT group',
'title': 'Chinese APT Exploits Critical VMware vCenter Flaws in Global Cyber '
'Campaign',
'type': ['APT Attack', 'Ransomware'],
'vulnerability_exploited': ['CVE-2026-59310', 'CVE-2026-59309']}