CTI · corroborated · 2026-08-14

Hackers Exploit Critical VMware vCenter Flaw to Deploy Reverse SSH Across 47 Countries

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1105 Ingress Tool Transfer Command and Control
• T1572 Protocol Tunneling Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Reverse SSH Client Execution on vCenter Management Hosts
id: ea07cf1a-13c5-4176-b65c-b448a3cca468
status: experimental
description: >
    Detects execution of the open-source reverse_ssh reverse-shell
    framework (NHAS/reverse_ssh) on management hosts, consistent with the
    active campaign exploiting CVE-2026-59310 (directory traversal in the
    VMware vCenter Syslog Server, disclosed 2026-07-29). QUIRSO observed
    compromised vCenter systems connecting to attacker-controlled
    infrastructure from 2026-08-03 to deploy reverse_ssh, which makes
    outbound connections to bypass inbound restrictions. reverse_ssh is also
    used legitimately in authorized penetration testing, so hits require
    follow-up validation for unauthorized installs and unexpected outbound
    SSH tunnels from vCenter hosts.
references:
    - https://gbhackers.com/hackers-exploit-critical-vmware-vcenter-flaw/
    - https://cyberpress.org/critical-vmware-vcenter-directory-traversal-flaw/
    - https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
    - https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
author: Tia N. List
date: 2026/08/14
tags:
    - attack.t1572
    - attack.t1105
    - attack.t1190
logsource:
    category: process_creation
    product: linux
detection:
    selection_reverse_ssh:
        Image|endswith:
            - '/reverse_ssh'
    condition: selection_reverse_ssh
falsepositives:
    - Authorized penetration testing and red-team operations legitimately deploy reverse_ssh
    - Attacker-renamed binaries evade name-based detection; corroborate with outbound SSH tunnel telemetry from vCenter hosts
level: high

Splunk SPL raw

# hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s — Splunk SPL variant (derived from hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s.sigma via sigma convert)
# source-sha256: 0aaff7a0aa0092c4bce1e467356bb4fe79ca2dddd1983fa478e3fb8ee41a8549 v1
Image="*/reverse_ssh"

KQL (Sentinel / Defender) raw

# hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s — KQL variant (derived from hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s.sigma via sigma convert)
# source-sha256: 0aaff7a0aa0092c4bce1e467356bb4fe79ca2dddd1983fa478e3fb8ee41a8549 v1
Image endswith "/reverse_ssh"

References

• https://gbhackers.com/hackers-exploit-critical-vmware-vcenter-flaw/
• https://cyberpress.org/critical-vmware-vcenter-directory-traversal-flaw/
• https://www.securityweek.com/critical-vmware-vcenter-vulnerability-in-attackers-crosshairs/
• https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/