Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
Summary: QUIRSO attributed exploitation of CVE-2026-59310, a directory-traversal flaw in Broadcom VMware vCenter with a CVSS score of 9.8 patched on July 29, 2026, to a suspected China-nexus actor, with activity beginning five days after public disclosure and an estimated 361 unique victim IP addresses compromised across 47 countries. The intrusion used malformed cron files to place a 'linuxFile' backdoor, reverse SSH binaries, and ultimately a Babuk-derived ransomware encrypting ESXi hosts with the '.babyk' extension, while a GitHub repository named 'pikpak0066/tmpclean' was linked to the same actor.
Why it matters: Exploitation of CVE-2026-59310 gave the actor immediate, non-interactive code execution as root on the vCenter Server appliance, and the ransomware may have served as a smokescreen to encrypt ESXi logs and deny defenders the telemetry needed to trace the intrusion.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-59309CVE-2026-59310
- Related