A fast-moving campaign is turning a VMware vCenter flaw into a route to full control of virtual infrastructure.
Attackers are abusing CVE-2026-59310, a critical path traversal bug in the Syslog Server, to run commands as root without a normal login.
The activity moved from disclosure to widespread exploitation in days. QUIRSO mapped 361 affected IP addresses in 47 countries, with technology, research, education and telecommunications environments among the sectors exposed.
The scale illustrates why vCenter management systems are such attractive targets.
QUIRSO GmbH said in a report shared with Cyber Security News (CSN) that it investigated a compromise where the intrusion progressed from likely unauthenticated code execution to persistent access, account creation, ESXi control and ransomware.
Its researchers assess, with moderate confidence, that a Chinese-speaking actor is behind the CVE-2026-59310 campaign, but do not link it to a named group.
The first observed victim connection occurred on August 3, five days after the vendor advisory. By August 5, 343 of the eventual 361 observed victim IPs had appeared.
That compressed timeline follows the scanning surge reported after these critical VMware security flaws emerged, and leaves little margin for defenders to treat internet-facing management systems as routine servers.
Syslog Flaw Opens Root Access
The initial intrusion was tied to malformed cron files that appeared under /etc/cron.d, including a name that referenced the CVE and Syslog service.
There were no matching authentication events, while the commands ran as root. This strongly supports the finding that attackers used the Syslog path traversal to write content into a location where cron would execute it.
The technique turns a management appliance into a launch point. Scheduled jobs downloaded tools, ran shell commands and used temporary folders for staging.
In the broader attack chain, this root access also enabled a web shell and password-free administrator rights for a legitimate service account. The risk is consistent with how the vCenter Syslog vulnerability enables remote execution without requiring prior access.
The actor then created several layers of return access. A system service restarted a backdoor, while fake tasks using VMware-like names repeatedly enabled SSH and placed an attacker key in root’s authorized keys.
The same campaign installed a web shell, created vSphere administrator accounts and retrieved credentials from the local directory service.
Researchers also observed an SSH-based reverse-tunnelling utility that makes the compromised host initiate an outbound connection to the operator.
That can evade controls built mainly to block unsolicited inbound access. Its unauthorised presence, together with recurring cron activity or unexpected vCenter egress, warrants investigation rather than being dismissed as an administrator tool.
ESXi Encryption Raises Impact
After inventory discovery, the attackers created local administrator accounts on ESXi hosts and copied a ransomware executable, plus scripts, through the vSphere datastore browser.
The helper script stopped running virtual machines, launched the encryptor against VMFS volumes and removed the VMware high-availability agent. That sequence can turn one vCenter compromise into a widespread availability incident.
The payload used a Babuk-derived encryptor and changed affected data to a distinct new extension. Large VMDK files were only partially encrypted, with the first 512 MB targeted, but that can still make virtual machines unusable.
The use of this ransomware family alone is not reliable attribution, a useful distinction amid other ESXi ransomware attacks that also target shared virtual-disk storage.
Defenders should apply the relevant vCenter updates immediately because no workaround replaces patching.
They should also remove direct public access to management interfaces, restrict administration to approved networks, review new accounts and sudoers changes, and examine cron, service and web-application directories for the listed signs.
This is especially urgent while attackers scanning VMware vCenter systems following disclosure.
Threat hunters should scan vCenter appliances for unauthorized remote-access and backdoor tools using available YARA content, then correlate any match with unexpected outbound connections and file or task creation.
Organizations that find these traces should treat the appliance and reachable ESXi estate as potentially compromised, preserve logs before cleanup, rotate exposed credentials and begin incident response.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| IP address | 146.59.252.178 |
Observed probing and vSphere REST API discovery associated with the separate, possible CVE-2026-59309 activity track |
| IP address and port | 185.144.28.120:3232 |
Payload hosting infrastructure used to retrieve the downloader and architecture-specific remote-access payloads |
| URL | http://185.144.28.120:3232/esxi.sh |
Downloader script retrieved through malicious cron activity |
| URL | http://185.144.28.120:3232/esxi_amd64 |
Example architecture-specific payload URL generated by the downloader |
| IP address and port | 192.255.141.13:8080 |
Infrastructure referenced by additional malicious cron activity |
| IP address and port | 5.34.176.100:5244 |
Server hosting an AList directory used as a payload repository |
| WebSocket URL | ws://intel.se9ly9upbhay.shop:8080/ws |
Command-and-control endpoint contacted by the first deployed backdoor |
| URL | https://profound-beijinho-504b1f.netlify.app/ |
Additional payload-hosting location |
| Domain | tmpfiles.org |
Third-party hosting service used for tool staging |
| IP address | 146.56.116.119 |
Suspected test or staging system connection observed in reverse SSH backend logs |
| Hostname | kali.kali |
Identifier for the suspected attacker test and staging system |
| File name | zz-poc59310-syslog.log |
Malformed cron-related file linked to initial path traversal activity |
| File name | zz-poc59310 |
Related malicious cron artifact named after CVE-2026-59310 |
| File name | linuxFile |
First backdoor deployed after initial access |
| File name | systemlog |
Name used for a downloaded copy of the backdoor |
| File name | linux_x86 |
Name used for payload staged from the Netlify page |
| File name | esxi.sh |
Downloader and persistence installer for the SSH-based remote-access payload |
| File name | esxi_amd64 |
Architecture-specific remote-access payload for x86-64 systems |
| Directory | /tmp/.x/ |
Central attacker staging directory |
| Directory | /root/.local/share/cg4nQW9TOxeq/ |
Location where a copy of the first backdoor was placed |
| Service | sys-9436d8.service |
System service created to restart the deployed backdoor |
| Service | network-manager |
System service name used by the remote-access installer for persistence |
| Cron task prefix | vmware-vpxd-stats-* |
VMware-like scheduled tasks used to enable SSH and add an attacker key for root |
| Cron task prefix | vmware-perf-collect-* |
VMware-like scheduled tasks used to deploy a JSP web shell |
| Cron task prefix | vmware-perf-sync-* |
VMware-like scheduled tasks used for web shell deployment and account creation |
| Web shell | vmware-perf-update.jsp |
JSP web shell written into the Perfcharts web application directory |
| File path | /etc/sudoers.d/vmware-perf |
Malicious sudoers file granting the perfcharts account passwordless root access |
| File name | .vmware-perf-upd.sh |
Hidden script used for credential access and privileged directory modification |
| File name | .ldappw |
Temporary password file used with LDAP utilities |
| File name | .sso_domain |
Temporary file containing the discovered SSO domain |
| File name | sso_domain.txt |
SSO-domain file placed in Perfcharts web directories |
| Account name | adminuser |
vSphere SSO account and separate ESXi local administrator account created during the intrusion |
| Account name | vcadmin |
vSphere account created through a Base64-encoded Python script |
| Account name | vcenter_admin |
Account created during the possible CVE-2026-59309 activity track |
| File name | backup |
Babuk-derived ESXi ransomware executable |
| SHA-1 hash | e876ceb47ba092420a97724a957152b3808568b0 |
SHA-1 hash of the backup ransomware executable |
| File name | run.sh |
Helper script used to prepare ransomware execution on ESXi hosts |
| File name | _post_launch.sh |
Script staged and executed before SSH access to ESXi hosts |
| File extension | .babyk |
Extension added to encrypted files by the ransomware payload |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.