VMware vCenter Path Traversal Abused by China-Linked APT to Deploy Babuk Ransomware: 361 IPs Across 47 Countries

German forensics firm QUIRSO reports CVE-2026-59310 (CVSS 9.8) + CVE-2026-59309 vCenter auth bypass exploited 5 days after Broadcom's 29 July disclosure. Attackers landed via Syslog path traversal, planted a `reverse_ssh` persistence channel, then launched a Babuk-family encryptor with .babyk suffix on ESXi. 361 victim IPs across 47 countries; Germany/US/Turkey/Iran/France top five.

Incident Overview

German digital-forensics firm QUIRSO published its postmortem of a global VMware vCenter campaign in August 2026. CVE-2026-59310 vCenter Syslog service directory traversal (CVSS 9.8) and CVE-2026-59309 vCenter Directory Service auth bypass (CVSS 9.8), disclosed in Broadcom VMSA-2026-0006 on 29 July, were scanned the day they went public. Within five days, 361 victim IPs across 47 countries. Attackers took vCenter Server Appliance management-plane access, dropped a persistence channel, and launched a Babuk-family encryptor with .babyk suffix on ESXi hosts. QUIRSO attributes this with medium confidence to a Chinese-speaking APT. Evidence: leftover Chinese strings in script comments/HTTP bodies, citations of public research from domestic security conferences, admin-tool and log filenames that reuse CVE IDs, and a victim profile that deliberately avoids mainland China IPs.

Technical Details

Kill chain starts with unauthenticated network access to vCenter 443:

• Initial delivery: CVE-2026-59310 Syslog path traversal lets the attacker write arbitrary files to VCSA without auth (e.g. system-level cron). Clears the path for later execution;
• Auth takeover: CVE-2026-59309 bypasses vCenter Directory Service auth in parallel. Attacker gets vCenter management-plane rights, can call vSphere API to create local accounts and change system config;
• Persistence: cron periodically pulls a shell script from a designated IP and executes it. Script embeds `reverse_ssh` (open-source reverse SSH framework) as C2. `reverse_ssh` dials out, so it bypasses inbound defenses in outbound-NAT-only enterprise nets;
• Lateral + ransomware: Babuk-family ransomware on ESXi encrypts VMFS datastores and uses .babyk as the file extension. Matches the family reused after the 2021 Babuk source leak.

Key timeline:

• 2026-07-29: Broadcom publishes VMSA-2026-0006. Broadcom FAQ reported no observed exploitation at the time;
• 2026-08-03: QUIRSO catches compromised VCSA talking to attacker infrastructure;
• 2026-08-05: 95% of the 361 victim IPs already show infection signs;
• 2026-08-22: CISA adds same-week high-severity Oracle HTTP Server/WebLogic Server Proxy Plug-in CVE-2026-21962 to KEV. Supply-chain-style infra attacks accelerating.

Broadcom published no official workaround for CVE-2026-59310. The patch is the only known initial-entry mitigation.

Impact

• Patched versions: VCSA 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k / 8.0 U2f and later branches. All previously officially supported vCenter 7/8/9 releases are affected;
• Geography: Germany, United States, Turkey, Iran, France total 185 victim IPs. China is not among the victims, further supporting deliberate avoidance;
• Affected virtualization platforms include vSphere, VMware Cloud Foundation, vSphere Foundation;
• Ransomware .babyk matches the family that evolved after the 2021 Babuk source leak. Uses ESXi shell commands to blast-encrypt VMFS datastores across the cluster.

Remediation

• Upgrade vCenter immediately to 9.1.0.0300 / 9.0.2.0100 / 8.0 U3k / 8.0 U2f or later. After upgrade, restart vSphere Client, vCenter, and ESXi immediately. Rolling-upgrade each node separately on HA/DRS clusters;
• Inspect and wipe all cron entries on vCenter (`/var/spool/cron/` and `/etc/crontab`). Hunt pull scripts with external URLs and cron-job modification records;
• Hunt ransomware residue with ESXi:

find / -name '*.babyk' -o -name 'HOW_TO_DECRYPT*'

No `*.babyk` files and no `HOW_TO_DECRYPT.txt` should exist;

• Audit recently created vCenter admin accounts. Disable, delete, and invalidate login sessions for anomalies;
• Review outbound SSH. `reverse_ssh` builds a TCP 22 reverse tunnel to attacker-controlled servers. Block known C2 IPs in firewall/SDN;
• Source-IP whitelist + mandatory SSH 2FA on all management planes (vCenter, ESXi management);
• Fold vSphere upgrade and credential rotation into a 24-hour change window. Refresh vCenter SSO password, ESXi root password, and vSphere Automation script credentials;
• Temporary containment for unpatched instances: disable Syslog remote ingest. Restrict vCenter 443 to jump-host egress IPs only.

References

• Broadcom VMSA-2026-0006
• Rapid7: VMSA-2026-0006 detailed analysis
• CISA KEV catalog
• Semalt: Exploitation Speed Outpaces Patching — vCenter Five-Day Collapse