"A Chinese Hacking Crew Turned a VMware Bug Into a Ransomware Pipeline"

Patch VMware vCenter before you do anything else this week. Security researchers have attributed active exploitation of CVE-2026-59310, a severe directory traversal vulnerability in vCenter Server, to a suspected China-nexus advanced persistent threat group. The attacks were first flagged on Monday, 17 August 2026, and the payload at the end of the chain is a Babuk-derived ransomware strain.

Directory traversal bugs let an attacker read or write files outside the folders they should have access to. In vCenter, that means an attacker who gets a foothold on the management network can walk past authentication checks and reach files that control the entire virtual infrastructure. From there, deploying ransomware across every VM a company runs is a short hop, not a long one.

This is the second VMware vCenter flaw to make headlines this month. Broadcom patched a separate authentication bypass, CVE-2026-59309, on 3 August. That one let a network-adjacent attacker skip login entirely. CVE-2026-59310 is a different bug with a different mechanism, but the pattern is the same: attackers are treating vCenter as the soft underbelly of enterprise virtualisation, because compromising the management plane compromises everything it manages.

Why Babuk, and why it matters

Babuk is an older ransomware family whose source code leaked years ago, which means variants of it now circulate freely among less sophisticated crews as well as state-linked operators looking to blend in with common criminal activity. Using a Babuk derivative as the final payload is a deliberate choice: it muddies attribution, since the ransomware itself doesn't point cleanly back to a nation-state actor even when the initial access and lateral movement look highly coordinated.

For a China-nexus group, ransomware isn't necessarily about the ransom. It can be a smokescreen for espionage, a way to destroy evidence of what was accessed before deployment, or straightforward disruption of a target considered strategically useful to hit. Enterprises running vCenter without the latest patches should assume any of those motives is in play.

What to do about it

If you administer VMware infrastructure, the priority list is short and non-negotiable. Patch vCenter to the version that closes CVE-2026-59310 immediately. Check vCenter access logs for directory traversal patterns and unexpected file reads outside standard configuration paths. Segment vCenter's management network from general enterprise traffic if it isn't already isolated, and make sure backups of your virtual infrastructure are offline or immutable, since ransomware crews increasingly hunt down and encrypt backup repositories before triggering the main payload.

This follows a broader trend security researchers have been tracking through August: virtualisation and hypervisor management tools have become one of the most targeted categories of enterprise software, precisely because compromising one server can mean compromising hundreds of virtual machines in a single move. Cisco IOS XE, Jenkins, Veeam ONE and JetBrains TeamCity have all seen actively exploited critical flaws in the same window. If your organisation runs any of that stack, this is a good week to check patch status across the board, not just on vCenter.