A fast-moving campaign is turning a VMware vCenter flaw into a route to full control of virtual infrastructure.

Attackers are abusing CVE-2026-59310, a critical path traversal bug in the Syslog Server, to run commands as root without a normal login.

The activity moved from disclosure to widespread exploitation in days. QUIRSO mapped 361 affected IP addresses in 47 countries, with technology, research, education and telecommunications environments among the sectors exposed.

The scale illustrates why vCenter management systems are such attractive targets.

QUIRSO GmbH said in a report shared with Cyber Security News (CSN) that it investigated a compromise where the intrusion progressed from likely unauthenticated code execution to persistent access, account creation, ESXi control and ransomware.

Its researchers assess, with moderate confidence, that a Chinese-speaking actor is behind the CVE-2026-59310 campaign, but do not link it to a named group.

The first observed victim connection occurred on August 3, five days after the vendor advisory. By August 5, 343 of the eventual 361 observed victim IPs had appeared.

That compressed timeline follows the scanning surge reported after these critical VMware security flaws emerged, and leaves little margin for defenders to treat internet-facing management systems as routine servers.

Syslog Flaw Opens Root Access

The initial intrusion was tied to malformed cron files that appeared under /etc/cron.d, including a name that referenced the CVE and Syslog service.

There were no matching authentication events, while the commands ran as root. This strongly supports the finding that attackers used the Syslog path traversal to write content into a location where cron would execute it.

The technique turns a management appliance into a launch point. Scheduled jobs downloaded tools, ran shell commands and used temporary folders for staging.

In the broader attack chain, this root access also enabled a web shell and password-free administrator rights for a legitimate service account. The risk is consistent with how the vCenter Syslog vulnerability enables remote execution without requiring prior access.

The actor then created several layers of return access. A system service restarted a backdoor, while fake tasks using VMware-like names repeatedly enabled SSH and placed an attacker key in root’s authorized keys.

AList directory observed on actor-controlled infrastructure hosting Reverse SSH payloads (Source - Medium) — AList directory observed on actor-controlled infrastructure hosting Reverse SSH payloads (Source – Medium)

The same campaign installed a web shell, created vSphere administrator accounts and retrieved credentials from the local directory service.

Researchers also observed an SSH-based reverse-tunnelling utility that makes the compromised host initiate an outbound connection to the operator.

That can evade controls built mainly to block unsolicited inbound access. Its unauthorised presence, together with recurring cron activity or unexpected vCenter egress, warrants investigation rather than being dismissed as an administrator tool.

ESXi Encryption Raises Impact

After inventory discovery, the attackers created local administrator accounts on ESXi hosts and copied a ransomware executable, plus scripts, through the vSphere datastore browser.

The helper script stopped running virtual machines, launched the encryptor against VMFS volumes and removed the VMware high-availability agent. That sequence can turn one vCenter compromise into a widespread availability incident.

The payload used a Babuk-derived encryptor and changed affected data to a distinct new extension. Large VMDK files were only partially encrypted, with the first 512 MB targeted, but that can still make virtual machines unusable.

The use of this ransomware family alone is not reliable attribution, a useful distinction amid other ESXi ransomware attacks that also target shared virtual-disk storage.

Defenders should apply the relevant vCenter updates immediately because no workaround replaces patching.

They should also remove direct public access to management interfaces, restrict administration to approved networks, review new accounts and sudoers changes, and examine cron, service and web-application directories for the listed signs.

This is especially urgent while attackers scanning VMware vCenter systems following disclosure.

Threat hunters should scan vCenter appliances for unauthorized remote-access and backdoor tools using available YARA content, then correlate any match with unexpected outbound connections and file or task creation.

Organizations that find these traces should treat the appliance and reachable ESXi estate as potentially compromised, preserve logs before cleanup, rotate exposed credentials and begin incident response.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
IP address	`146.59.252.178`	Observed probing and vSphere REST API discovery associated with the separate, possible CVE-2026-59309 activity track
IP address and port	`185.144.28.120:3232`	Payload hosting infrastructure used to retrieve the downloader and architecture-specific remote-access payloads
URL	`http://185.144.28.120:3232/esxi.sh`	Downloader script retrieved through malicious cron activity
URL	`http://185.144.28.120:3232/esxi_amd64`	Example architecture-specific payload URL generated by the downloader
IP address and port	`192.255.141.13:8080`	Infrastructure referenced by additional malicious cron activity
IP address and port	`5.34.176.100:5244`	Server hosting an AList directory used as a payload repository
WebSocket URL	`ws://intel.se9ly9upbhay.shop:8080/ws`	Command-and-control endpoint contacted by the first deployed backdoor
URL	`https://profound-beijinho-504b1f.netlify.app/`	Additional payload-hosting location
Domain	`tmpfiles.org`	Third-party hosting service used for tool staging
IP address	`146.56.116.119`	Suspected test or staging system connection observed in reverse SSH backend logs
Hostname	`kali.kali`	Identifier for the suspected attacker test and staging system
File name	`zz-poc59310-syslog.log`	Malformed cron-related file linked to initial path traversal activity
File name	`zz-poc59310`	Related malicious cron artifact named after CVE-2026-59310
File name	`linuxFile`	First backdoor deployed after initial access
File name	`systemlog`	Name used for a downloaded copy of the backdoor
File name	`linux_x86`	Name used for payload staged from the Netlify page
File name	`esxi.sh`	Downloader and persistence installer for the SSH-based remote-access payload
File name	`esxi_amd64`	Architecture-specific remote-access payload for x86-64 systems
Directory	`/tmp/.x/`	Central attacker staging directory
Directory	`/root/.local/share/cg4nQW9TOxeq/`	Location where a copy of the first backdoor was placed
Service	`sys-9436d8.service`	System service created to restart the deployed backdoor
Service	`network-manager`	System service name used by the remote-access installer for persistence
Cron task prefix	`vmware-vpxd-stats-*`	VMware-like scheduled tasks used to enable SSH and add an attacker key for root
Cron task prefix	`vmware-perf-collect-*`	VMware-like scheduled tasks used to deploy a JSP web shell
Cron task prefix	`vmware-perf-sync-*`	VMware-like scheduled tasks used for web shell deployment and account creation
Web shell	`vmware-perf-update.jsp`	JSP web shell written into the Perfcharts web application directory
File path	`/etc/sudoers.d/vmware-perf`	Malicious sudoers file granting the `perfcharts` account passwordless root access
File name	`.vmware-perf-upd.sh`	Hidden script used for credential access and privileged directory modification
File name	`.ldappw`	Temporary password file used with LDAP utilities
File name	`.sso_domain`	Temporary file containing the discovered SSO domain
File name	`sso_domain.txt`	SSO-domain file placed in Perfcharts web directories
Account name	`adminuser`	vSphere SSO account and separate ESXi local administrator account created during the intrusion
Account name	`vcadmin`	vSphere account created through a Base64-encoded Python script
Account name	`vcenter_admin`	Account created during the possible CVE-2026-59309 activity track
File name	`backup`	Babuk-derived ESXi ransomware executable
SHA-1 hash	`e876ceb47ba092420a97724a957152b3808568b0`	SHA-1 hash of the `backup` ransomware executable
File name	`run.sh`	Helper script used to prepare ransomware execution on ESXi hosts
File name	`_post_launch.sh`	Script staged and executed before SSH access to ESXi hosts
File extension	`.babyk`	Extension added to encrypted files by the ransomware payload

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post VMware Syslog Path Traversal Becomes Root RCE, Persistent SSH Access and ESXi Ransomware appeared first on Cyber Security News.