China-Nexus Actor Exploits CVE-2026-59310 in 361 VMware vCenter Instances Across 47 Countries

The initial access chain abused vCSA syslog to plant malformed cron files named zz-poc59310-syslog.log in /etc/cron.d, triggering wget or curl fetches of the linuxFile backdoor from 5.34.177[.]38:9861. A parallel campaign used CVE-2026-59309 for authentication bypass, creating the vcenter_admin account from 146.59.252[.]178 with REST API calls masquerading as VCF Fleet traffic. Victim counts peaked in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). Chinese-language scripts, tool reuse from domestic security research, and exclusion of mainland China targets underpin the moderate-confidence attribution.

The rapid five-day turnaround from public disclosure to weaponized cron abuse matches documented Chinese APT patterns of treating published PoCs as operational triggers rather than research artifacts. Compartmentalized handling of the two CVEs on the same appliance and absence of login events from the newly created admin account indicate deliberate operational security tradecraft aimed at espionage persistence before ransomware staging.

Broadcom’s July 29 patch window left a narrow but exploitable interval that state-aligned actors have repeatedly leveraged for vSphere management-plane access. The Babuk-derived payload suggests convergence of espionage and financial coercion objectives, with vCenter control enabling both data exfiltration and downstream ransomware deployment against enterprise and critical-infrastructure tenants.

Defenders should immediately audit cron.d directories and newly created vCenter accounts on appliances exposed after July 29; continued scanning for the 5.34.177[.]38 infrastructure is expected through at least October 2026.