Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware

A suspected Chinese state-aligned APT group is actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in Broadcom's VMware vCenter Server, to establish root-level control over victim infrastructure. The campaign, which began shortly after the July 29, 2026 patch release, has compromised hundreds of servers across 47 countries, with researchers observing distinct Chinese-language artifacts and operational timing consistent with UTC+08:00.

Upon gaining access via the unauthenticated code execution flaw, attackers deploy a custom Linux implant and create backdoor accounts to maintain persistence. The intrusion culminates in the deployment of a Babuk-derived ransomware variant targeting ESXi hosts, although analysts suggest this may serve as a distraction to obscure broader espionage or sabotage activities.