Suspected China-linked hackers exploit VMware flaw across 47 countries

A suspected China-linked advanced persistent threat actor has been actively exploiting a critical vulnerability in Broadcom's ↘ 0.14% VMware vCenter Server, compromising systems across 47 countries and deploying ransomware derived from the Babuk family, according to research published by German incident response firm QUIRSO.

The vulnerability, CVE-2026-59310, is a directory-traversal flaw in the vCenter Syslog server component carrying a CVSS score of 9.8. It allows an unauthenticated attacker with network access to execute arbitrary code with root privileges. Broadcom disclosed and patched the flaw on July 29, but exploitation began just five days later on August 3.thehackernews+1

Scale and Attribution

QUIRSO estimates 361 unique victim IP addresses have been compromised, with the highest concentrations in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). The Shadowserver Foundation has issued a special report confirming that victims should be considered "fully compromised" due to the deployment of reverse SSH persistence mechanisms.shadowserver+1

QUIRSO assessed with moderate confidence that the campaign is operated by a Chinese-speaking threat actor working in the UTC+08:00 time zone. The attribution rests on Chinese-language artifacts in attacker scripts, reuse of research from a Chinese security publication, operational use of Chinese-language tools, victimology excluding mainland China, and activity patterns consistent with Chinese working hours.thehackernews

Attack Chain

The exploitation chain begins with a malformed cron file that triggers a curl or wget command to retrieve a backdoor dubbed "linuxFile," which communicates with its command-and-control server over a WebSocket channel using XOR-obfuscated addressing. The attacker then deploys reverse SSH binaries for persistent access, creates rogue administrator accounts on vCenter and ESXi hosts, and escalates privileges through compromised VMware Directory Service credentials.thehackernews

The campaign culminates in the deployment of ransomware encrypting files with the ".babyk" extension on ESXi hosts. However, QUIRSO suspects the ransomware may serve as a smokescreen rather than the primary objective, designed to encrypt ESXi log files and destroy forensic evidence of the broader intrusion.thehackernews

Market Impact and Outlook

The disclosure contributed to a roughly 6% drop in Broadcom shares on Friday, erasing nearly $120 billion in market value. VMware forms the core of Broadcom's infrastructure-software business, generating $7.2 billion in fiscal second-quarter revenue. Analysts broadly maintain positive ratings on the stock ahead of third-quarter earnings due September 2.stocktwits+1

In a follow-up analysis, QUIRSO identified a GitHub repository linked to the threat actor, created on August 14, that disguises reverse SSH binaries as a legitimate Linux temporary file cleaner — an apparent effort to systematically wipe intrusion artifacts from compromised systems. Broadcom's advisory states there is no workaround for CVE-2026-59310, making patching the sole remediation.broadcom+1