When hackers were exploiting the severe vulnerability in VMware vCenter, they were busy creating administrator accounts and backdoor access. Later files with .babyk extension began popping up. The research group which investigates this attack believes that the ransomware functioned like a diversion instead of being used for monetary gain.
What is CVE-2026-59310? The Directory Traversal flaw in VMware vCenter Syslog Server with severity CVSS 9.8. An attacker with network access to the vCenter server can perform arbitrary code execution. The vulnerability was fixed by Broadcom on July 29, 2026, and the absence of workaround was confirmed.
Five Days From Patch To First Victim
The fix was released by Broadcom on July 29 along with other vulnerabilities of VMware products. A workaround was not provided, so patching became the only possible solution.
The first victims began contacting the attacker infrastructure on August 3.
And what happened then? On August 4, 151 new victims were identified. The number increased to 340 on August 5 and exceeded 360 addresses in a week. They were registered in 47 countries including Germany, the US, Turkey, Iran and France 5 countries which account for more than half.
There are two important remarks on the number above. First, it represents the number of IP addresses, not the number of companies under attack. Second, some of them belong to hosting and shared infrastructure companies. And finally, it is a figure from the second week of August.
What Was Built Before Anything Got Encrypted
The post-exploitation activities conducted during this campaign seem to be designed for creating persistence. Administrative accounts have been created using names which can survive initial investigations such as vcenter_admin, adminuser, and vcadmin. Multiple accounts have been created in the vSphere SSO Administrators group providing full rights throughout the whole virtual environment.
LinuxFile backdoor has been created and scheduled using cron jobs. Web shells and SSH connections have been created simultaneously with that method of access. The sudo configuration has been changed to enable escalation of privileges, and vCenter credentials have been obtained using registry keys and Python modules.
It should be noted that all the above-listed actions are not obligatory for conducting an extortion attack.
What vCenter Controls, and Why Patching It Is Hard
Nothing on this list is reached by attacking a virtual machine. All of it is reached by attacking the console that manages them.
Compromising a virtual machine gets an attacker one workload. Compromising vCenter gets them the layer that owns all of them.
The Ransomware Looks Like An Afterthought
Files encrypted by this group include the .babyk file extension. Though the Babuk code was released many years ago and used to produce several other codes, its inclusion here does not imply anything about who operates the ransomware but rather the fact that the ransomware is part of the Babuk family.
It has been proposed that the use of encryption was meant to obfuscate evidence more than collect ransom payments. This is only an assumption and should not be taken for granted but it follows the known order of operations.
Consider the effects of encryption on the vCenter appliance that has been breached. Log files, timestamps, and all other useful information that could help determine how the breach took place would become unavailable because of encryption. In such a scenario, the victim would ask for advice on how to recover from the ransomware rather than ask what came in and out of their environment.
One Server, Every Virtual Machine
Attribution falls into the mid-range confidence category. Rationale includes artifacts in the attackers’ toolkit written in the Chinese language, the Chinese language toolkit, timings that correlate to the time zone UTC+08:00, and a victimology that rules out mainland China. There have been no named groups involved.
What’s important isn’t who but what they’ve targeted. A vCenter serves as the console from which the control over all virtual machines in an estate is conducted, and one breach gives access to everything below.
This is what makes a five-day window so significant in this case. We saw the same attack vector just a little while ago, when a national IT agency was breached through SharePoint flaws Microsoft had already fixed.
Evidence Is A Control, Not A Byproduct
Security professionals generally consider logs to be a form of diagnostic output. In this attack, however, they become the target.
Where the log of the event remains on the system attacked, the attacker, who has administrative control over the system, decides whether the log remains intact. Encrypting the log becomes one method of doing so. Deleting the log quietly becomes another.
Regulatory bodies and insurance companies increasingly demand proof of events rather than just stories about them. For this proof, evidence must be gathered that the attacker could not have reached. From a hacked vCenter appliance, there will not be much of that.
Conclusion: The Ransomware Came Last. The Access Came First.
The defining lesson from this campaign is not the .babyk extension left behind after encryption. It is what attackers established before encryption began.
CVE-2026-59310 provided a path to arbitrary code execution on vCenter, a management system with authority across the virtual environment. Post-exploitation activity then built durable access: administrative accounts were added to the vSphere SSO Administrators group, cron persistence and the LinuxFile backdoor were established, web shells and SSH provided additional access paths, privilege configuration was modified, and credentials were obtained. By the time ransomware appeared, the intrusion had already moved well beyond the vulnerability that opened the door.
Whether encryption was deliberately used to obscure evidence remains an assessment, not a confirmed motive. But the sequence still matters. If defenders treat encryption as the beginning of the incident, they risk recovering from the visible impact while leaving behind accounts, credentials, backdoors, and other access created earlier in the compromise.
Why This Threat Matters
- vCenter is a control plane, not just another server. Compromising it can expose administrative authority over hosts, virtual machines, storage, networking, snapshots, and access control.
- The patch window collapsed quickly. Victim activity was observed only days after Broadcom released the fix, leaving little tolerance for delayed remediation.
- Post-exploit persistence matters more than the final payload. Administrative accounts, backdoors, cron jobs, web shells, and SSH access can survive a response focused only on encrypted files.
- Ransomware can distort incident scope. Encryption creates an obvious recovery problem while earlier attacker activity may represent the more important security failure.
- Management-plane credentials expand the consequence. Access obtained from vCenter can provide reach beyond the appliance itself.
- Evidence stored only on a compromised system cannot be assumed trustworthy. Administrative control may give an attacker opportunities to destroy, alter, or encrypt the records defenders need to reconstruct the intrusion.
Where Defensive Control Must Operate
For this attack pattern, defensive control begins by closing the known vCenter exposure before exploitation occurs, then governing what executes if that boundary is crossed.
Xcitium Vulnerability Assessment helps identify vulnerable and exposed infrastructure, patch gaps, and affected systems that require urgent remediation. With no workaround available for CVE-2026-59310, identifying unpatched vCenter instances and driving them toward the fixed release is the primary control.
Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform addresses the post-exploit execution layer on supported managed systems. Execution Governance becomes relevant when exploitation transitions into backdoors, persistence mechanisms, tools, or ransomware execution, where unknown code should not receive unrestricted runtime rights before trust exists.
Patch the Console. Rebuild the Trust.
Recovery should not stop when encryption stops. A compromised vCenter should trigger review of newly created administrative identities, SSO membership, credentials, cron jobs, web shells, SSH access, privilege changes, and other persistence established before the ransomware appeared. Evidence needed for investigation should also exist outside infrastructure the attacker was able to administer.
The visible payload may be ransomware. The more consequential compromise is the privileged access established before it arrived.
