China-Nexus APT Exploits CVE-2026-59310 for Babuk Ransomware

A critical directory traversal vulnerability in VMware vCenter Server (CVE-2026-59310, CVSS 9.8) is under global mass exploitation by a suspected China-nexus APT. The attackers leverage a flaw in the Syslog service to achieve remote code execution without authentication, affecting multiple versions of vCenter, Cloud Foundation, and Telco Cloud platforms. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgency of remediation.

The attack chain involves writing malformed cron files to the vCenter Server Appliance (vCSA) to establish root-level persistence. Following initial access, the actors deploy the 'linuxFile' backdoor and Reverse SSH clients to maintain a foothold and harvest SSO credentials. The ultimate objective is lateral movement to ESXi hypervisors to deploy Babuk-derived ransomware, which encrypts virtual machine disk files using the '.babyk' extension.

This campaign has targeted over 360 unique victim IP addresses across 47 countries, including significant clusters in Germany, the United States, and Turkey. Organizations running vulnerable VMware infrastructure must apply Broadcom’s security patches immediately or isolate management interfaces to prevent full environment encryption and data loss.