361 unique victim IP addresses across 47 countries were flagged in a campaign that used a recently patched VMware vCenter vulnerability to gain root execution and, in at least one case, deploy a Babuk-derived ransomware locker that appends “.babyk” to encrypted files.
CVE-2026-59310: a directory-traversal flaw weaponized within days
Broadcom released a fix for CVE-2026-59310 on July 29, 2026. Researchers at German incident response company QUIRSO report that the first observed exploitation activity began five calendar days after the vulnerability’s public disclosure. The flaw is a severe directory‑traversal vulnerability in the VMware vCenter Server appliance (vCSA) that can be leveraged to execute arbitrary code in a root context on the appliance.
QUIRSO’s analysis shows an early execution pattern in which a malformed cron file named "zz-poc59310-syslog.log" was placed under /etc/cron.d. That file triggered a curl or wget retrieval of a backdoor from 5.34.177[.]38:9861 and—after execution—was removed, indicating automated, non‑interactive exploitation that immediately yielded privileged control.
Attribution, time zone signals, and affected geography
QUIRSO assessed with moderate confidence that the campaign was run by a Chinese-speaking actor likely operating in the UTC+08:00 time zone. The firm’s researchers—Maike Orlikowski, Çağatay Yürekli, and Denis Szadkowski—cited Chinese‑language artifacts in attacker scripts, reuse of research from a Chinese security publication, repeated operational use of Chinese‑language tools and management software, victimology that excluded mainland China, and activity patterns compatible with UTC+08:00 working hours.
The operation is estimated to have touched 361 unique victim IPs across 47 countries, with the largest tallies in Germany (55), the U.S. (41), Turkey (38), Iran (26), and France (25).
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDual exploitation: CVE-2026-59309 and CVE-2026-59310 on the same appliance
QUIRSO analyzed one compromised vCenter appliance that showed evidence of activity tied to both CVE-2026-59309—an authentication bypass that was also subject to active scanning—and CVE-2026-59310. Signs of CVE-2026-59309 exploitation appeared as early as August 1, 2026, followed by creation of an administrative account from IP 146.59.252[.]178 and vSphere discovery via the REST API using User-Agent strings such as "GoodMoodle-VCFleet/1.0" to masquerade as VMware-related activity.
QUIRSO noted that the newly created "vcenter_admin" account was not later used in the observed phases tied to CVE-2026-59310, and said there was no overlap between the CVE-2026-59309 events and the abuse chain that began on August 3 tied to the directory traversal.
Malware, persistence, and operational tradecraft
The principal implant identified by QUIRSO is a backdoor tracked as "linuxFile" (also referenced as systemlog or linux_x86). The implant establishes a WebSocket connection to a command‑and‑control (C2) endpoint—decoded at run time from XOR‑obfuscated data—and runs attacker instructions through /bin/sh. According to Denis Szadkowski, the malware protects traffic with its own application‑layer cryptography despite using an unencrypted ws:// transport, automatically reconnects on failure, and contains persistence routines for systemd and cron.
The actor used cron extensively to stage and run payloads. Examples include a cron job fetching "esxi.sh" from 185.144.28[.]120:3232; that script acted as a downloader and installed an architecture‑specific reverse SSH client retrieved from the same server. Other cron entries referenced 192.255.141[.]13:8080 and 5.34.176[.]100:5244, and the latter host exposed the reverse SSH binaries via an AList directory listing—an apparent operational security error that revealed toolset artifacts.
QUIRSO documented a set of impersonations and persistence actions: cron jobs labeled vmware-vpxd-stats-*, vmware-perf-collect-*, and vmware-perf-sync-* that dropped a JSP web shell ("vmware-perf-update.jsp"), added the actor’s SSH key to authorized_keys, executed Base64‑encoded scripts to harvest credentials, and created vSphere identities such as "adminuser" and "vcadmin." The actor also created a sudoers file at /etc/sudoers.d/vmware-perf granting "perfcharts" unrestricted, non‑interactive passwordless sudo access to root.
Ransomware deployment and the “smokescreen” hypothesis
QUIRSO observed the deployment of a ransomware locker on ESXi hosts that encrypted files with the ".babyk" extension, a pattern associated with Babuk-derived ransomware. Researchers cautioned that it is unclear whether the locker was the primary objective or an opportunistic payload selected to confuse attribution and analysis. Szadkowski suggested the locker could have functioned as a smokescreen, encrypting ESXi log files to reduce forensic visibility and hinder defenders from reconstructing the intrusion.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: expect to hunt for the specific indicators and behaviors QUIRSO detailed—malformed cron files such as "zz-poc59310-syslog.log," suspicious cron jobs impersonating VMware services, unexpected authorized_keys additions, the presence of linuxFile processes connecting over ws:// to intel.se9ly9upbhay.shop:8080/ws, and newly created vSphere accounts like "adminuser" and "vcadmin."
- Policymakers and regulators: will note the rapid exploitation timeline—activity commencing five days after public disclosure—and the availability of a Broadcom fix released July 29, 2026, when evaluating timelines for coordinated vulnerability disclosure and mandatory patching expectations.
- Affected enterprises and procurement leaders: should be aware that the campaign touched at least 47 countries and that attackers used vCenter‑level control to create accounts, modify vmdir entries, and place sudoers and cron‑based persistence—actions that enable lateral movement to ESXi hosts and, ultimately, ransomware encryption.
QUIRSO’s findings offer a detailed playbook of how CVE-2026-59310 was weaponized: directory traversal to place cron entries in a privileged execution location, automated retrieval of backdoors and reverse‑SSH clients, credential theft through vmdir and vmafd calls, and the eventual use of a Babuk‑derived locker that may have been intended to obscure the intrusion. The analysis leaves a pointed practical question unresolved by the evidence so far: was the locker the objective, or a deliberate diversion to deny telemetry and extend the attacker’s window of freedom?
