VMware vCenter Ransomware: Suspected China APT Exploits CVE-2026-59310 (August 2026)

VMware vCenter: What Happened

In August 2026, VMware vCenter servers worldwide were targeted in a critical ransomware incident attributed to a suspected China-linked advanced persistent threat (APT). The attackers exploited CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter, to gain unauthorized access and execute arbitrary code. Following initial compromise, the threat actors installed a persistent backdoor and a reverse SSH binary, subsequently deploying Babuk-derived ransomware. Analysis indicates the ransomware was likely used as a diversionary tactic, hindering forensic efforts rather than serving as the primary objective.

Attack Vector & Technical Detail

The intrusion was facilitated by CVE-2026-59310, a critical vulnerability in VMware vCenter allowing directory traversal and arbitrary code execution. The attackers leveraged this flaw to establish initial access, aligning with MITRE ATT&CK tactics TA0001 (Initial Access), TA0005 (Defense Evasion), and TA0040 (Impact). Once inside, they deployed a custom backdoor and a reverse SSH binary to maintain persistence and enable remote control. The Babuk-derived ransomware was then executed, encrypting critical data and further complicating incident response. Notably, the use of ransomware appears intended to disrupt investigations and erase traces of the attackers’ activities.

Confirmed Impact

The compromise resulted in the disruption of VMware vCenter server operations across multiple global organizations. The installation of backdoors and ransomware led to the encryption of system files, impeding business continuity and potentially delaying recovery efforts. Additionally, the encryption of forensic evidence by the ransomware deployment has hindered post-incident investigations, raising concerns about the full extent of data exposure and system compromise. Regulatory implications may arise for affected organizations, particularly those handling sensitive or regulated data, due to the potential loss of control over critical infrastructure and evidence.

What This Means for Your Organization

This incident underscores the critical importance of timely patch management and layered defense strategies for organizations running VMware vCenter or similar infrastructure. The exploitation of CVE-2026-59310 demonstrates how unpatched vulnerabilities can be rapidly weaponized by sophisticated threat actors. Organizations should prioritize vulnerability management, monitor for unusual SSH activity, and implement robust backup and recovery procedures to mitigate the impact of ransomware and related attacks. Proactive threat hunting for signs of compromise and defense evasion is essential to detect and contain such threats before significant damage occurs.

Detection & Response

• Immediate: Isolate affected VMware vCenter servers from the network to prevent lateral movement and further data encryption.
• Hunt: Search for unauthorized SSH binaries, backdoor artifacts, and evidence of Babuk-derived ransomware execution on vCenter hosts.
• Patch: Apply the official VMware patch addressing CVE-2026-59310 across all vCenter deployments without delay.

Source: https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html