Executive Summary
In a severe escalation targeting hypervisor infrastructure, cybersecurity researchers at The Hacker News and QUIRSO have attributed widespread intrusions against Broadcom VMware vCenter Server instances to an advanced persistent threat (APT) actor assessed to have a China-nexus. The intrusions center on the active weaponization of CVE-2026-59310 (CVSS score: 9.8) and CVE-2026-59309 (CVSS score: 9.8)—critical vulnerabilities in the vCenter management plane that allow unauthenticated remote attackers to execute arbitrary code with root privileges.
Threat intelligence confirms that upon compromising vulnerable vCenter servers, the attackers deploy persistent backdoors (tracked as ForestTiger), establish persistent reverse tunnels, and leverage hypervisor administrative control to distribute customized, Babuk-derived ransomware across all managed ESXi hosts, encrypting virtual disk images (.vmdk) and paralyzing enterprise virtualized environments.
Technical Vulnerability Analysis: VMSA-2026-0006
Broadcom released security advisory VMSA-2026-0006 to address five critical flaws spanning VMware vCenter Server, VMware ESXi, Workstation, and Fusion. The primary vectors exploited in the wild include:
CVE-2026-59310: Directory Traversal & Unauthenticated Arbitrary File Write (CVSS 9.8)
* Vulnerability Mechanism: The vCenter Server management interface contains an unsanitized path parameter in its API communication endpoint. Unauthenticated remote threat actors construct HTTP POST requests with directory traversal sequences (e.g., ../../../../) to write arbitrary files to restricted locations on the underlying Linux filesystem (Photon OS).
* Code Execution Path: By overwriting critical configuration files or dropping webshells into web-accessible Tomcat directories (/usr/lib/vmware-vsphere-ui/server/work/), attackers obtain immediate unauthenticated remote code execution (RCE) with the privileges of the vsphere-ui service account, which is readily escalated to root via local configuration bypasses.
CVE-2026-59309: Authentication Bypass in vCenter Management Plane (CVSS 9.8)
* Vulnerability Mechanism: A flaw in the parsing and token validation routines of the session management subsystem permits attackers to forge administrative authentication tokens. This grants complete access to the vSphere Client API without requiring valid administrative credentials.
Attack Phase
Action and Technical Outcome
Initial Access
External threat actor exploits CVE-2026-59310 (Unauthenticated Path Traversal) to write a Web Shell to /usr/lib/vmware-vsphere-ui/.
Privilege Escalation
Attacker executes arbitrary commands via the web shell and escalates privileges to root on the vCenter Server.
Persistence
Deployment of the "ForestTiger" persistent stealth backdoor to maintain control and bypass standard monitoring.
Lateral Movement
Attacker queries managed ESXi Hypervisors using internal API keys and pushes Python & ELF ransomware payloads.
Impact
Termination of active Virtual Machine processes (esxcli vm kill) and encryption of VMDK/VMX configuration files (Babuk variant).
Post-Exploitation Tactics & Babuk Ransomware Deployment
Forensic investigations highlight a rapid progression from perimeter exploit to full hypervisor lockout:
1. Deployment of ForestTiger Backdoor: Attackers install ForestTiger, a lightweight Linux backdoor that communicates over encrypted WebSockets disguised as standard telemetry traffic. ForestTiger handles reverse shell sessions, credential scraping from vCenter memory pools, and command staging.
2. ESXi Host Enumeration & Credential Harvesting: Using vCenter's built-in vpxuser credentials and SSH keys, the attackers pivot downstream to every connected ESXi host without encountering authentication challenges.
3. Execution of Babuk-Derived Linux Ransomware: The actors execute scripts that invoke ESXi command-line utilities (esxcli vm process kill --type=force) to terminate all running virtual machines. A customized ELF binary derived from leaked Babuk source code then traverses the /vmfs/volumes/ datastores, rapidly encrypting .vmdk, .vmsn, and .vmx files using ChaCha20/Curve25519 cryptography, leaving standard recovery methods impossible without offsite backups.
Industry Impact & Critical Risks
* Complete Virtual Data Center Compromise: Because vCenter serves as the centralized nervous system for virtualized computing, storage, and networking, a single exploit gives attackers direct dominion over hundreds of production virtual machines, including domain controllers, database clusters, and cloud backup gateways.
* Absence of Workarounds: Broadcom confirmed that no configuration workarounds or temporary mitigations exist for CVE-2026-59310 and CVE-2026-59309. Patching is the only viable remediation.
* Target Profile: Global telecom operators, government IT hubs, financial processing networks, and managed service providers (MSPs) hosting multi-tenant private clouds are the primary targets of this campaign.
Remediation Guidelines & Immediate Action Plan
1. Apply Official VMware Security Patches:
Upgrade VMware vCenter Server installations to the patched release versions specified in Broadcom Advisory VMSA-2026-0006:
* VMware vCenter Server 8.0 -> Update to 8.0U3b or higher
* VMware vCenter Server 7.0 -> Update to 7.0U3r or higher
* VMware Cloud Foundation 5.x / 4.x -> Apply corresponding asynchronous patch bundles.
2. Isolate Management Interfaces:
* Ensure port 443 (HTTPS) and port 5480 (VAMI) of vCenter Server and all ESXi management ports (SSH/Web) are never exposed to the public internet.
* Enforce strict micro-segmentation, restricting management access to dedicated, jump-box subnets accessible only via hardware-backed multi-factor authentication (MFA).
3. Forensic Audit & Web Shell Detection:
Inspect vCenter and ESXi datastores for anomalous files and rogue user accounts:
* Audit the /usr/lib/vmware-vsphere-ui/server/work/ and /tmp/ directories for unknown .jsp, .sh, or ELF executables.
* Review /var/log/vmware/vpxd/vpxd.log and /var/log/audit.log for unusual directory traversal sequences (..%2f) and unexpected API token generation events.
4. Enforce Immutable, Air-Gapped Backups:
Ensure hypervisor backups and virtual machine disk snapshots are replicated to air-gapped, immutable storage repositories situated outside the VMware Active Directory domain and vSphere management trust boundary.