A suspected China-nexus actor reportedly exploited CVE-2026-59310 only 5 days after disclosure, compromising an estimated 361 IPs across 47 countries.
The attack chain reportedly went from:
vCenter → Root Access → Credential Theft → ESXi → Babuk-derived ransomware
The interesting part is how the attackers turned a vCenter compromise into control of the underlying virtualization infrastructure.
I broke down the full attack chain, persistence mechanisms, credential harvesting, ESXi lateral movement, and ransomware deployment.
I was ready to harp on the 361 installs that left vCenter open publicly, but there’s a little more nuance.
The issue is with the syslog service, which could be configured to take input from Guest OSes (which that is a bad practice too, but less than a public facing vCenter).
Realistically the syslog service within vCenter should only be for management logs from the control plane. If you want to stream that to a centralized aggregator after that to cross reference logs then that would work too and not leave you compromised.
The interesting part is how the attackers turned a vCenter compromise into control of the underlying virtualization infrastructure.
Not really, that’s the management layer - it has authority over everything.
It’s why we secure access to such stuff.