CTI · reviewed · 2026-08-19
Suspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi Ransomware
Actors
Chinese-speaking threat actor
Malware / tools
Babuk-derived ransomware
Campaigns
vCenter exploitation campaign
CVEs
CVE-2026-59310CVE-2026-59309
Victim sectors
technologygovernmentfinance
Geography
GermanyUnited StatesTurkeyIranFrance
MITRE ATT&CK
Indicators
No curated indicators tied to this case.
Detections
No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.