China-Nexus APT Exploits VMware vCenter Vulnerability to Deploy Ransomware
In August 2026, a suspected China-nexus advanced persistent threat (APT) exploited CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter Server, to execute arbitrary code. This campaign compromised 361 unique IP addresses across 47 countries, including Germany, the U.S., Turkey, Iran, and France. The attackers deployed Babuk-derived ransomware on ESXi hosts, encrypting files with the ".babyk" extension, potentially as a smokescreen to distract defenders and hinder forensic analysis. This incident underscores the urgency for organizations to promptly apply security patches, especially for critical vulnerabilities in widely used infrastructure. The rapid exploitation following public disclosure highlights the need for proactive vulnerability management and robust incident response strategies to mitigate the risks posed by sophisticated threat actors.
Kill Chain
