Attackers Are Inside vCenter: A Suspected China-Linked Group Turned a Two-Week-Old VMware Flaw Into 361 Compromised Servers

Ransomware teams have a new favorite entrance, and it sits at the center of most corporate virtualization stacks. Since early August, a suspected China-linked intrusion group has been breaking into VMware vCenter servers through a pair of critical flaws patched on July 29, and German incident response firm QUIRSO now counts 361 victim IP addresses across 47 countries.

The numbers come from telemetry shared with The Hacker News this week. Germany leads the victim list with 55 compromised servers, followed by the United States with 41, Turkey with 38, Iran with 26, and France with 25. QUIRSO says the campaign started roughly five days after Broadcom made the fixes public — fast enough to suggest the group was already watching for the disclosure and had exploit tooling ready to go.

The flaws behind the break-ins

Two vulnerabilities do most of the heavy lifting. The first, CVE-2026-59309, is an authentication bypass in the VMware Directory Service, the component that manages identities inside vCenter. It carries a CVSS score of 9.8 out of 10. An attacker who reaches the service over the network can skip login entirely and land on the management plane.

The second, CVE-2026-59310, is a directory traversal bug in the vCenter Syslog server, also rated 9.8. Broadcom's advisory describes it as a path where a remote attacker can execute arbitrary code. Neither flaw needs credentials, and neither has a workaround. Broadcom classified the updates as an emergency change and told customers to apply them immediately, even though at the time it said it had seen no in-the-wild exploitation.

That window closed quickly. Rapid7, which published a technical breakdown the day after the advisory, warned that vCenter has landed on CISA's Known Exploited Vulnerabilities catalog ten times for other issues, and that attackers "are known to target critical issues in this product." Within two weeks, QUIRSO was documenting a global exploitation campaign using both bugs.

What QUIRSO actually saw on the inside

The group's playbook is now public in unusual detail, because QUIRSO obtained access to one compromised vCenter Server Appliance and watched the attack unfold.

On one box, both flaws were used. The CVE-2026-59309 path produced evidence of malicious activity as early as August 1, including the creation of an administrative account on vCenter. No login events preceded it — the account simply appeared, created from the IP address 146.59.252.178. Two days later, the same server showed REST API calls to vSphere using a user-agent string of "GoodMoodle-VCFleet/1.0," an attempt to look like legitimate VMware Cloud Foundation management traffic.

The CVE-2026-59310 exploitation started on August 3 and followed a different route. QUIRSO's analysis found the vCSA syslog server had been abused to drop files into a privileged execution location: a malformed cron file named "zz-poc59310-syslog.log" — a direct nod to the CVE identifier and the fact the tooling came from a public proof-of-concept — appeared under /etc/cron.d, and at least one file executed and placed a backdoor on the system.

That backdoor, called "linuxFile," opens a WebSocket connection to a controller, waits for instructions, and executes them through /bin/sh. Its command-and-control address is XOR-obfuscated and decoded only at runtime, and the malware carries its own application-layer encryption on top of an unencrypted ws:// transport. It reconnects automatically after failures and installs persistence through both systemd and cron.

Cron jobs, reverse SSH, and a web shell named "vmware-perf-update"

What follows is a masterclass in blending in. The attackers leaned on cron heavily, setting up jobs that impersonate legitimate VMware services:

• vmware-vpxd-stats-* — adds the attacker's SSH public key to the authorized_keys file, opening a remote access channel.
• vmware-perf-collect-* — drops a JSP web shell named vmware-perf-update.jsp.
• vmware-perf-sync-* — drops the same web shell and runs a Base64-encoded script that harvests credentials and creates an account called "adminuser," which is then added to the vSphere SSO Administrators group.

Other steps included creating a file at /etc/sudoers.d/vmware-perf that grants the "perfcharts" service account passwordless sudo access to root, and running scripts that extract the vmdir machine credentials by querying the HKEY_THIS_MACHINE\services\vmdir registry location, falling back to VMware's vmafd Python module if that fails. Stolen credentials were then used to add attacker accounts to the Administrators group, and local accounts were created on ESXi hosts to prepare for file encryption.

The infrastructure behind all of this is spread across several IPs, including 5.34.177.38 (backdoor delivery), 185.144.28.120 (a shell script downloader), and 192.255.141.13. One server at 5.34.176.100 left an AList directory listing exposed, which gave researchers a peek at the reverse SSH binaries — an operational security slip that handed defenders the attacker's own toolset.

A ransomware drop that looks like a smokescreen

The final stage deployed ransomware that encrypts ESXi host files with a ".babyk" extension, which security researchers associate with Babuk-derived lockers. QUIRSO is careful not to over-interpret this: the analysis covers only one infected system, and the team suspects the locker may not have been the campaign's main goal. Denis Szadkowski, one of the QUIRSO researchers, likened the ransomware to a smokescreen — encrypting ESXi logs destroys telemetry that would otherwise help defenders trace the intrusion, while drawing attention away from the primary objective.

The same group appears to be tidying up after itself, too. In a follow-up analysis, QUIRSO linked the attacker to a GitHub repository called "pikpak0066/tmpclean," a Go-based tool presented as an automatic cleaner for Linux temporary directories. The repo was created on August 14, and researchers independently confirmed the binaries in its releases are reverse SSH builds matching the attacker's infrastructure. Given that most malicious artifacts in these intrusions are staged in /tmp, the tool looks like a systematic effort to wipe forensic evidence every hour, deleting anything older than 24 hours. A release tagged v3.0.0 even bundles updated reverse SSH binaries, suggesting the group is distributing new payloads through the GitHub vector.

Why this matters for anyone running vCenter

Attribution is still an assessment rather than a certainty. QUIRSO puts moderate confidence on a Chinese-speaking group operating in the UTC+08:00 time zone, based on Chinese-language artifacts in attacker scripts, reuse of research from a Chinese security publication, Chinese-language tooling, victimology that excludes mainland China, and activity patterns that match working hours in that region.

The practical takeaways are more certain. Both flaws are pre-auth, both are rated 9.8, and neither has a workaround — patching is the only fix. The fixed builds are vCenter 8.0 U3k, Cloud Foundation and vSphere Foundation 9.1.0.0300 and 9.0.2.0100, and an async patch for Cloud Foundation 5.x. Any vCenter management interface reachable from a network the attacker can touch should be treated as exposed, because the two-week gap between patch and mass exploitation is now the norm for critical infrastructure software. Broadcom says there is no evidence the issues were exploited before disclosure; the same cannot be said for the three weeks since.

For defenders, the QUIRSO write-up is worth reading in full, because the indicators are specific enough to hunt on: malformed cron files referencing CVE numbers, user-agent strings trying to impersonate VCF Fleet, JSP web shells named vmware-perf-update.jsp, and new accounts added to the SSO Administrators group. Each of those is a queryable signal in most SIEM deployments.

The bigger pattern

vCenter is not an outlier. Management planes for core infrastructure — hypervisors, backup systems, VPN gateways, file-sharing servers — have become the favorite target of ransomware groups in 2026, because compromising one console controls everything beneath it. The same week Broadcom patched these flaws, defenders were juggling alerts on other products in the same class. The response pattern is consistent: patch management-plane software within days, segment management networks, watch for accounts created with no login history, and treat public proof-of-concept code as a countdown timer rather than a research curiosity.

The Cybersecurity category on this site has covered several of these campaigns, including ransomware crews chaining SonicWall zero-days and a Conti-derived gang eating VPN gateways. This vCenter campaign follows the same arc with a new twist — a cleanup tool designed to erase its own tracks. QUIRSO's full technical breakdown is available on Medium, with the follow-up analysis of the tmpclean repository here. Broadcom's advisory is VMSA-2026-0006, and Rapid7's technical assessment lives on the Rapid7 blog.