Suspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi Ransomware

The bug is CVE-2026-59310, a directory traversal in the vCenter Server Syslog Server that Broadcom rated CVSS 9.8 and disclosed on July 29, 2026, and it converts to remote code execution as root. Exploitation writes attacker-controlled content through the Syslog Server into /etc/cron.d/, where the planted entry zz-poc59310-syslog.log executes a root-level command that downloads and launches a payload named linuxFile. From root on the appliance the actor, assessed by incident responders at QUIRSO as Chinese-speaking, harvests directory credentials, installs multiple backdoors, and drops a Babuk-derived ransomware build on the ESXi hypervisors the appliance manages. QUIRSO treats CVE-2026-59309, present in the same incident set, as a separate and possibly unrelated track.

Five days separate the advisory from the first observed victim callbacks on August 3, and that gap is the real finding: the patch race was lost before most maintenance windows opened. The cron entry embeds the CVE id and the string poc, which suggests tooling assembled from a public proof of concept almost immediately after disclosure, meaning internet-exposed Syslog Server endpoints were enumerable and attackable by anyone, not just a well-resourced crew. Root on vCenter is not one compromised box; it is the credential store for the virtual estate plus control of every managed host, and the QUIRSO count of 361 unique victim IPs across 47 countries, led by Germany, the United States, Turkey, Iran, and France, shows exactly that spread, concentrated in technology firms, universities, research organizations, telecoms, and network-service providers. The sequencing matters most for the victims: directory credentials were stolen and backdoors planted before encryption, so the ransomware is the exit event of an espionage-grade foothold, and rebuilding encrypted ESXi hosts evicts nothing while appliance-side access and stolen directory credentials survive.

Patch vCenter Server to the fixed build named in the July 29 advisory and keep the Syslog Server off the internet until that is done; a 9.8 traversal that writes cron files has no legitimate exposed use case. On any appliance that was unpatched or internet-reachable at any point since July 29, enumerate /etc/cron.d/ for zz-poc59310-syslog.log, search the filesystem for linuxFile, and review appliance egress back to August 3 for callbacks to attacker infrastructure. Rotate directory credentials the appliance could read and treat every ESXi host it manages as credential-bearing; where Babuk-derived encryption is confirmed, restore from clean backups and rebuild rather than clean in place. Restrict vCenter management and syslog interfaces to administration networks, and alert on file creation under /etc/cron.d/ on the appliance itself.

Two developments would change this assessment. Confirmation that CVE-2026-59309 was exploited by the same actor would turn a single-patch emergency into a two-bug hunt with a second unknown fixed build to chase. A public IoC drop from QUIRSO or vendor, or leak-site listings tied to the Babuk derivative, would widen the hunt from 361 known IPs to every vCenter operator, and a re-issued advisory with updated fixed builds would signal the actor or the bug moved faster than the first patch.