Full Report
Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code
Analysis Summary
# Threat Actor: Unnamed (Suspected China-nexus APT)
## Attribution & Identity
* **Identification:** Attributed with moderate confidence to a Chinese-speaking threat actor/APT.
* **Aliases/Associations:** No specific named alias (e.g., APT#) provided, but identified as a "China-nexus" actor.
* **Attribution Factors:**
* Operational hours consistent with UTC+08:00.
* Use of Chinese-language artifacts in attacker-created scripts.
* Reuse of research from Chinese security publications.
* Utilization of Chinese-language tools and management software.
* Victimology specifically excludes mainland China.
## Activity Summary
* **Campaign:** Global exploitation of VMware vCenter vulnerabilities following public disclosure in late July 2026.
* **Timeline:** Exploitation began approximately August 1, 2026 (five days after patch release).
* **Scope:** Approximately 361 unique victim IP addresses compromised across 47 countries.
## Tactics, Techniques & Procedures
* **Vulnerability Exploitation:**
* **CVE-2026-59310:** Directory-traversal vulnerability used for remote code execution (RCE).
* **CVE-2026-59309:** Authentication bypass used to create administrative accounts.
* **Persistence:**
* Abuse of the `crond` (cron daemon) to execute malicious tasks.
* Creation of a rogue administrative account named `vcenter_admin`.
* **Evasion/Masquerading:**
* Use of the User-Agent string `GoodMoodle-VCFleet/1.0` to mimic legitimate VMware Cloud Foundation (VCF) Fleet activity.
* Naming malicious log files (e.g., `zz-poc59310-syslog.log`) to blend in with vCenter Server Appliance (vCSA) syslog conventions.
* **Communication:**
* Use of WebSockets for Command and Control (C2).
* XOR-obfuscated C2 addresses decoded at run-time.
* **Execution:** Leveraging `/bin/sh` to execute commands received via backdoors.
## Targeting
* **Sectors:** Not explicitly limited to one sector; targets any organization running vulnerable VMware vCenter instances.
* **Geography:** Global (47 countries). Highest concentration in:
* Germany (55)
* United States (41)
* Turkey (38)
* Iran (26)
* France (25)
* **Victims:** 361 unique IP addresses; specific organizational names were not disclosed.
## Tools & Infrastructure
* **Malware:**
* **linuxFile:** A backdoor implant providing remote command execution via WebSockets.
* **Babuk-Derived Ransomware:** The article notes the deployment of ransomware derived from leaked Babuk source code.
* **Infrastructure:**
* 5.34.177[.]38 (Used to host the `linuxFile` backdoor)
* 146.59.252[.]178 (Source of administrative account creation/scanning)
* **Utilities:** `curl`, `wget`, `cron`.
## Implications
* **Strategic Threat:** This actor demonstrates high agility, weaponizing critical vulnerabilities within days of public disclosure.
* **Ransomware Shift:** The use of Babuk-derived ransomware by a suspected China-nexus APT suggests a potential shift toward financially motivated operations or the use of ransomware as a "distraction" or "wiper" for espionage purposes.
* **Infrastructure Risk:** Since vCenter manages entire virtualized environments, a compromise grants the actor "keys to the kingdom" over all hosted virtual machines.
## Mitigations
* **Patching:** Immediate update of VMware vCenter to versions addressing CVE-2026-59310 and CVE-2026-59309.
* **Log Auditing:** Inspect `/etc/cron.d` for unauthorized files and review vCenter audit logs for the creation of unexpected accounts (e.g., `vcenter_admin`).
* **Network Segmentation:** Restrict access to the vCenter management interface to authorized administrative segments only; do not expose vCenter to the public internet.
* **Egress Filtering:** Monitor and block outbound connections to known malicious IPs and non-standard WebSocket traffic from management servers.