Suspected China-Nexus APT Exploits VMware vCenter Vulnerability CVE-2026-59310
In August 2026, a suspected China-nexus Advanced Persistent Threat (APT) group exploited CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter Server, to execute arbitrary code remotely. This exploitation led to the deployment of a backdoor and a reverse SSH binary, culminating in the installation of Babuk-derived ransomware. The ransomware deployment appeared to serve as a diversion, complicating forensic analysis and potentially masking the primary objectives of the intrusion. This incident underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure through known vulnerabilities. It highlights the necessity for organizations to promptly apply security patches and maintain vigilant monitoring to detect and mitigate such sophisticated attacks.
Kill Chain
