In what security researchers are calling one of the most aggressive exploitation campaigns of 2026, threat actors have compromised at least 361 unique VMware vCenter systems across 47 countries in a coordinated global offensive that began just five days after a critical vulnerability was publicly disclosed.
The campaign, detailed in a comprehensive report by QUIRSO’s Incident Response team, exploited CVE-2026–59310 a critical directory traversal vulnerability in the vCenter Syslog Server that allows unauthenticated remote code execution with a maximum CVSS score of 9.8. What makes this campaign particularly alarming is its speed, scale, and the sophistication of the threat actor behind it.
According to the investigation, the first compromised systems were observed connecting to attacker infrastructure on August 3, 2026—merely five calendar days after Broadcom published VMSA-2026–0006. Within just two days, by August 5, approximately 95% of the eventual 361 victim IPs had already been compromised.
“This wasn’t opportunistic scanning,” explained Maike Orlikowski, one of the QUIRSO researchers who authored the report. “This was a well-resourced, coordinated operation that moved with remarkable speed and precision.”
The attackers appear to have developed and deployed a working exploit within days of the vulnerability’s disclosure, suggesting either advance knowledge, exceptional reverse-engineering capabilities, or both. Once inside, they established persistent backdoor access using the open-source reverse_ssh framework, creating outbound connections from compromised systems that could potentially bypass network controls focused primarily on inbound traffic.
What Makes This Campaign Different
The exploitation campaign stands out for several reasons:
Speed of Exploitation: The five-day window between patch release and observed exploitation represents an exceptionally rapid timeline, even for well-resourced threat actors. This suggests the attackers either had early access to vulnerability details or possessed significant exploitation development capabilities.
Scale and Coordination: With 361 unique victim IPs across 47 countries, this represents a truly global campaign. Germany (55 IPs), the United States (41), Turkey (38), Iran (26), and France (25) were the most heavily affected countries.
Target Selection: The campaign appeared to target internet-accessible vCenter management infrastructure, with the strongest concentration in technology, software, and cybersecurity sectors, followed by higher education and research, and telecommunications providers.
Infrastructure Sophistication: The actors employed multiple staging servers, third-party hosting services, and custom tooling to maintain persistence and evade detection.
A Case Study in Modern Cyber Intrusion
One compromised vCenter Server Appliance provided researchers with a detailed view of the full attack chain. The intrusion revealed a sophisticated, multi-stage operation that appears to have involved at least two different threat actors one exploiting a related vulnerability, CVE-2026–59309, and another conducting the main CVE-2026–59310 campaign.
The CVE-2026–59309 Connection
On August 1, approximately 48 hours before the main campaign began, researchers observed signs of possible exploitation of a different vulnerability, CVE-2026–59309—an authentication bypass in VMware Directory Service. An administrative account was created through the vulnerable component, with the activity originating from IP address 146.59.252.178.
The same IP address was used for vSphere discovery via the REST API on August 3, using unusual user agents: “GoodMoodle-VCProbe/1.0” and “GoodMoodle-VCFleet/1.0.” While these user agents follow naming conventions that resemble legitimate VMware components, researchers could not match them to known tooling, suggesting custom development.
“The activities related to CVE-2026–59309 could not be strongly linked to the main CVE-2026–59310 campaign,” noted the QUIRSO report. “For now, this activity is cautiously being grouped as its own track of activities, possibly involving a different actor.”
The Main Event: CVE-2026–59310 Exploitation
The primary attack chain began on August 3 at 05:47:01 UTC, when cron logs showed a malformed file called “zz-poc59310-syslog.log” followed by chained command execution that downloaded and executed a backdoor while removing the initial suspicious log file.
The filename “zz-poc59310-syslog.log” provides a clear indicator of the exploitation vector. The “poc59310” portion matches the CVE number, while the “-syslog.log” suffix mirrors the vCSA remote syslog file naming convention. However, the file appeared under /etc/cron.d rather than the configured syslog output directory, confirming that the vCSA syslog server was abused to place files in a privileged execution location.
Notably, no matching authentication events were identified around the time the first malformed cron entries appeared. This strongly suggests unauthenticated remote code execution via the path traversal vulnerability exactly what CVE-2026–59310 describes.
The Actor’s Toolbox: Persistence, Execution, and Evasion
The threat actor demonstrated extensive knowledge of VMware environments and sophisticated operational security. Their toolkit included:
Execution Mechanisms: The attackers relied heavily on cron for scheduled execution, with numerous malicious commands registered as cron jobs running in the root context. Rather than deploying complex standalone launchers, they predominantly used standard command and script interpreters, particularly /bin/sh and Bash, along with native utilities like curl and wget.
Payload Staging: Multiple actor-controlled and third-party hosting services were used to distribute tooling. A central staging directory, /tmp/.x/, was used extensively. One server, 5.34.176[.]100:5244, hosted an AList directory listing containing the threat actor’s tooling, including Reverse SSH binaries.
Persistent Backdoors: The actor deployed multiple persistence mechanisms:
- A systemd service (“sys-9436d8.service”) configured to restart the first backdoor binary placed in /root/.local/share/cg4nQW9TOxeq/
- Multiple cronjobs impersonating legitimate VMware services (vmware-vpxd-stats-, vmware-perf-collect-, vmware-perf-sync-*)
- A JSP webshell placed in the vCSA perfcharts Tomcat web application area
- SSH public key installation for backdoor access
- Creation of privileged user accounts
Network Evasion: The use of outbound connections from compromised systems to attacker infrastructure could potentially bypass controls focused primarily on unsolicited inbound traffic, making detection more challenging.
Attribution: A Chinese-Nexus Advanced Persistent Threat
While the investigation is ongoing, QUIRSO researchers have identified evidence pointing to a Chinese-nexus advanced persistent threat (APT). The attribution assessment is based on several factors:
Operational Security Mistakes: The investigation uncovered linguistic artifacts and infrastructure patterns consistent with known Chinese APT operations.
Targeting Patterns: Notably, no victims were identified in mainland China, a pattern frequently observed in Chinese-nexus APT operations where domestic targets are avoided.
Timing and Sophistication: The rapid development of working exploits following public disclosure aligns with the capabilities of well-resourced state-backed groups.
Tooling and Tradecraft: The use of custom user agents, specific staging patterns, and persistence mechanisms shows operational maturity consistent with APT-level adversaries.
However, QUIRSO acknowledges that their assessment may evolve as new evidence emerges. “We continue to track the campaign as it develops,” the researchers noted. “This article presents our current findings on its scale, victimology, infrastructure, tooling, and attribution, while acknowledging that the assessment may evolve as new evidence emerges.”
Impact on Organizations and Infrastructure
The campaign’s scope and targeting have significant implications for organizations worldwide. The affected systems span:
- Technology and Cybersecurity Companies: The hardest-hit sector, suggesting attackers were specifically targeting technology infrastructure
- Higher Education and Research: A secondary focus, indicating interest in intellectual property and research data
- Telecommunications and Network Services: Critical infrastructure providers that form the backbone of national and regional communications
For organizations running VMware vCenter, this campaign represents a significant threat. The ability for unauthenticated attackers to execute arbitrary code on internet-facing vCenter instances provides a direct path to:
- Complete control over virtualization infrastructure
- Access to all hosted virtual machines and their data
- Credential theft and lateral movement across networks
- Potential ransomware deployment, as demonstrated in the case study
- Long-term persistent access for espionage or future operations
10 Critical Actions for Security Teams
Based on the QUIRSO investigation, security teams should take immediate action:
1. Patch Immediately
Apply the VMSA-2026–0006 update for CVE-2026–59310 without delay. This vulnerability has a CVSS score of 9.8 and is being actively exploited.
2. Assess Internet Exposure
Review all vCenter instances for internet exposure and minimize external access. Consider placing management interfaces behind VPNs or jump hosts.
3. Investigate for Compromise
Check for indicators of compromise including:
- Unexpected cron jobs (particularly those impersonating VMware services)
- Systemd services with suspicious names
- Presence of reverse_ssh binaries
- Unusual outbound connections to IPs associated with the campaign (5.34.177.38, 185.144.28.120, 192.255.141.13, 5.34.176.100)
4. Review User Accounts
Check for unauthorized administrative accounts, particularly “vcenter_admin” or similarly named accounts created unexpectedly.
5. Implement Threat Intelligence Sharing
Join information sharing communities and report any suspicious activity. The attackers were observed across multiple countries, and collective defense is essential.
6. Deploy YARA Rules
Implement the YARA rule published by QUIRSO for detecting reverse_ssh builds. Note that reverse_ssh is a legitimate dual-use security tool, so detections should be correlated with unauthorized installation and other signs of compromise.
7. Monitor Syslog Files
Pay special attention to syslog entries containing path traversal patterns (../../../) or unusual timestamps.
8. Review Web Application Directories
Check vCSA perfcharts Tomcat web application directories for unauthorized JSP files, particularly “vmware-perf-update.jsp” or similarly named webshells.
9. Implement Zero Trust Architecture
Assume compromise and verify all access. Treat vCenter management as a high-value target requiring strict access controls and continuous monitoring.
10. Prepare Incident Response Plans
Develop specific playbooks for virtualization infrastructure compromise. The campaign shows attackers are moving toward ransomware deployment, making rapid response critical.
The Middle East and Africa Context
While the campaign is truly global, organizations in the Middle East and Africa should pay particular attention. The affected countries list includes multiple MEA nations, and the telecom and technology sectors – primary targets in this campaign – are critical for economic development in the region.
For organizations in the MEA region, several factors heighten the risk:
Rapid Digital Transformation: Many MEA organizations have accelerated cloud and virtualization adoption, potentially expanding attack surfaces.
Resource Constraints: Smaller security teams may struggle to keep pace with sophisticated APT campaigns.
Supply Chain Risks: The targeting of technology providers could impact downstream customers across the region.
Critical Infrastructure: Telecommunications and government systems are particularly attractive targets and were specifically targeted in this campaign.
What This Means for the Future of Cybersecurity
This campaign represents a significant escalation in cyber threat capabilities. The rapid exploitation of a critical vulnerability, combined with sophisticated persistence mechanisms and APT-level tradecraft, signals a new era of cyber conflict.
For cybersecurity professionals, this campaign underscores several important lessons:
Speed Matters: The five-day window between disclosure and exploitation means organizations must prioritize patch management like never before. In the age of APT-level exploitation, waiting even a week can be catastrophic.
Defense in Depth: The attackers’ use of outbound connections to bypass network controls highlights the importance of layered defense. Organizations cannot rely on perimeter security alone.
The Human Element: The campaign’s sophistication shows why trained security analysts remain essential. The QUIRSO researchers demonstrated the value of human expertise in uncovering and analyzing complex attacks.
Information Sharing: Collective defense is no longer optional. The global nature of this campaign means no single organization can defend against these threats alone.
Vulnerability Management as Strategic Priority: When a critical vulnerability is disclosed, organizations must assume exploitation is imminent not theoretical. This campaign proves that attackers can weaponize vulnerabilities in days, not weeks or months.
Conclusion
The global exploitation campaign targeting CVE-2026–59310 represents one of the most significant cybersecurity events of 2026. With 361 victim IP addresses across 47 countries, sophisticated persistence mechanisms, and evidence pointing to a Chinese-nexus advanced persistent threat, the campaign demonstrates the evolving capabilities of state-backed cyber adversaries.
For organizations running VMware vCenter, the message is clear: treat this threat with the urgency it deserves. Patch immediately, investigate for signs of compromise, and implement the defensive measures outlined in this article.
As the QUIRSO researchers noted, the assessment may evolve as new evidence emerges. The cybersecurity community must remain vigilant, share information, and continue tracking this campaign as it develops.
In an era where critical infrastructure and management systems are prime targets, the lessons from this campaign will inform defensive strategies for years to come. The attackers demonstrated speed, sophistication, and persistence qualities that defenders must match in their own operations.
