Suspected Chinese Hackers Exploit Critical VMware Flaw to Deploy Ransomware Across 47 Countries

A suspected China-linked threat actor has exploited a critical VMware vCenter vulnerability to compromise 361 systems across 47 countries, deploying Babuk-derived ransomware in an escalating cyberattack campaign that has alarmed enterprise security teams globally.

German incident response firm QUIRSO linked the attacks to CVE-2026-59310, a severe directory-traversal flaw scoring 9.8 out of 10 on the CVSS scale. The campaign began just five days after public disclosure of the vulnerability, raising urgent concerns about patch management and enterprise infrastructure security worldwide. The speed of exploitation underscores a well-documented and growing trend: threat actors are now weaponizing critical vulnerabilities faster than most organisations can respond.

The Scope and Origin of the Attack

Broadcom released a patch for CVE-2026-59310 on July 29, 2026. Within days, attackers moved aggressively to weaponize the flaw before organisations could apply the fix — a timeline that illustrates just how narrow the window between disclosure and exploitation has become.

QUIRSO researchers Maike Orlikowski, Çağatay Yürekli, and Denis Szadkowski assessed with moderate confidence that the campaign is operated by a Chinese-speaking threat actor working in the UTC+08:00 time zone. Their conclusion rests on a convergence of evidence.

"This assessment is based on the convergence of Chinese-language artifacts in attacker-created scripts, apparent reuse of research from a Chinese security publication, repeated operational use of Chinese-language tools and management software, victimology excluding mainland China, and activity patterns compatible with UTC+08:00 working hours," the researchers stated.

Countries bearing the heaviest infection burden include:

• Germany — 55 compromised IP addresses
• United States — 41 compromised IP addresses
• Turkey — 38 compromised IP addresses
• Iran — 26 compromised IP addresses
• France — 25 compromised IP addresses

The deliberate exclusion of mainland China from victim targets is a pattern historically associated with state-aligned advanced persistent threat actors and is one of the stronger behavioural indicators supporting QUIRSO's attribution assessment. When a threat actor systematically avoids targeting infrastructure within a specific nation-state, it frequently signals either political alignment or operational instruction to protect domestic systems.

How the Attack Unfolded

Initial Access and Reconnaissance

The intrusion chain exploited two separate VMware vulnerabilities in tandem. Attackers first leveraged CVE-2026-59309, an authentication bypass flaw, to gain initial access as early as August 1, 2026. Evidence shows the creation of a rogue administrative account originating from IP address 146.59.252[.]178.

Attackers then used User-Agent strings like "GoodMoodle-VCFleet/1.0" to disguise their reconnaissance activity as legitimate VMware traffic while conducting vSphere discovery via the REST API on August 3. This kind of deliberate masquerading within legitimate service traffic is a hallmark of sophisticated, operationally disciplined intrusion sets.

Exploitation and Root-Level Compromise

Exploitation of the more severe CVE-2026-59310 followed shortly after. The attack abused the vCenter Server Appliance syslog server to plant a malformed cron file named "zz-poc59310-syslog.log" in a privileged execution directory. The naming convention itself was a direct reference to the CVE identifier, confirming the use of a proof-of-concept built directly from publicly available vulnerability details — a reminder of how quickly published research translates into active weaponisation.

"Exploitation of CVE-2026-59310 provided the actor with immediate, non-interactive code execution in a root context on the vCenter Server appliance," the QUIRSO team explained. "Subsequent commands recorded by CROND were therefore already being executed as root, giving the actor unrestricted access to the underlying VCSA."

Backdoors, Web Shells, and Credential Theft

From that foothold, the attackers deployed a backdoor called "linuxFile", connecting to a command-and-control server via WebSocket. Denis Szadkowski told The Hacker News that "the C2 address is XOR-obfuscated and decoded at run-time while communications are protected using the malware's own application-layer cryptography despite using an unencrypted ws:// transport." The implant also automatically reconnects on failure and establishes persistence through systemd and cron.

The attackers further:

• Installed JSP web shells disguised as VMware services
• Created multiple rogue administrator accounts including "vcadmin" and "adminuser"
• Granted passwordless sudo access to a compromised service account
• Stole VMware directory credentials to conduct privileged directory modifications

In a move reminiscent of heist films where criminals pull the fire alarm to empty a building, ransomware encrypting files with the ".babyk" extension was ultimately deployed on ESXi hosts. The layered nature of this intrusion — spanning authentication bypass, root-level code execution, persistent backdoors, and credential theft — reflects a level of operational sophistication that extends well beyond opportunistic ransomware deployment.

Ransomware as Smokescreen and the GitHub Cleanup Tool

A Potential Diversion Tactic

QUIRSO investigators believe the ransomware deployment may not have been the campaign's primary objective. Szadkowski described it as a potential smokescreen "engineered to distract defenders from the main intrusion and thwart analysis by encrypting the ESXi log files thereby preventing access to telemetry data."

This is a critical distinction for incident response teams. When ransomware targets ESXi infrastructure, security teams must resist treating encryption as the end-point of the attack. The destruction of log files through encryption may be deliberately obscuring an earlier, deeper, and still-active compromise. Understanding how to respond effectively to a ransomware attack — including preserving telemetry before containment decisions are made — is essential when facing adversaries who weaponise the response process itself.

The Hidden GitHub Evidence-Wiping Tool

In a follow-up finding, QUIRSO identified a GitHub repository named "pikpak0066/tmpclean", created on August 14, 2026 and linked to the same threat actor. The repository presents itself as a Go-based tool to automatically remove old files from Linux temporary directories, with the description "Automatic /tmp cleaner daemon for Linux (Go)."

In reality, the tool scans the /tmp directory every hour and deletes any entries older than 24 hours. Since the majority of malicious artifacts from these intrusions are staged in /tmp, the tool functions as a systematic evidence-wiping mechanism — automated forensic counter-measure disguised as an open-source utility.

More concerning is that a release version named "tmpclean v3.0.0" contains updated reverse SSH binaries, suggesting the threat actor is also using the repository to distribute additional compiled payloads. The use of GitHub as a distribution and staging mechanism adds a layer of legitimacy that can complicate detection, as traffic to GitHub is rarely blocked or scrutinised at the network perimeter.

What Security and IT Teams Should Do Now

The campaign highlights three critical priorities for security and IT teams:

1. Patch immediately. Organisations running VMware vCenter should treat CVE-2026-59310 and CVE-2026-59309 as emergency patch priorities and audit all administrative accounts for unauthorised additions without delay. Broadcom's security advisory provides authoritative patching guidance.

2. Monitor persistence mechanisms. Security teams should monitor cron directories and systemd services for entries impersonating VMware service naming conventions, as these represent active attacker tradecraft confirmed in this campaign.

3. Treat ESXi ransomware as a secondary objective. Enterprises should treat ransomware deployment on ESXi infrastructure as a potential diversion rather than the primary threat. Log encryption may be obscuring a deeper and ongoing intrusion that warrants full forensic investigation before containment actions are finalised.