Suspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi Ransomware

A suspected Chinese-speaking threat actor has exploited a critical VMware vCenter Server vulnerability to gain root-level access, establish several backdoors, steal directory credentials, and deploy Babuk-derived ransomware on ESXi hypervisors.

The campaign targeted CVE-2026-59310, a critical directory-traversal flaw in VMware vCenter’s Syslog Server that can allow remote code execution.

Broadcom assigned the bug a CVSS score of 9.8 and disclosed it on July 29, 2026. Researchers observed the first compromised systems contacting attacker infrastructure on August 3 only five days later.

Security firm QUIRSO identified 361 unique victim IP addresses across 47 countries. Germany, the United States, Turkey, Iran, and France were the most affected locations.

The victims included technology firms, universities, research organizations, telecom companies, and network-service providers.

The researchers cautioned that IP addresses do not directly equal the number of victim organizations, as some systems may belong to shared hosting or cloud environments.

Chinese Actors Weaponize vCenter

The attackers appear to have abused the vulnerable vCenter Syslog Server to write malicious content into /etc/cron.d/, a directory used by Linux cron for scheduled task execution.

A suspicious file named zz-poc59310-syslog.log referenced the CVE number and triggered a root-level command that downloaded and launched a payload called linuxFile.

No matching authentication event was found around the initial execution. This strongly suggests the intruders used CVE-2026-59310 to obtain non-interactive code execution directly as root on the vCenter Server Appliance (VCSA).

The actors relied heavily on cron jobs running every minute. These jobs downloaded scripts, staged tools in /tmp/.x/, changed file permissions, and executed payloads using built-in Linux utilities such as curl, wget, Bash, and /bin/sh.

One early backdoor, linuxFile, connected to an attacker-controlled WebSocket server. The attackers also deployed the open-source Reverse SSH framework.

Reverse SSH creates an outbound connection from a compromised system to attacker infrastructure, allowing operators to access the target remotely without needing an inbound SSH connection.

For persistence, the group created a systemd service named sys-9436d8.service that repeatedly restarted the backdoor. It also created cron jobs designed to resemble normal VMware components, including names beginning with vmware-vpxd-stats-, vmware-perf-collect-, and vmware-perf-sync-.

These fake VMware tasks enabled SSH, inserted an attacker SSH key into root’s authorized keys, deployed a JSP web shell in a VMware Perfcharts directory, and granted the legitimate perfcharts service account passwordless sudo access.

This gave the operators multiple routes back into compromised vCenter appliances, medium said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR