VMware vCenter Server

The entry on Broadcom's VMSA-2026-0006 recorded five vCenter, ESX, Workstation and Fusion flaws, noted that none was reported exploited and that all had been reported privately to Broadcom. One of them has now been confirmed in use against real estates.

QUIRSO, a German security firm, reports that an incident-response engagement gave it visibility into an exploitation campaign against internet-accessible vCenter systems using CVE-2026-59310, the CVSS 9.8 directory traversal in the vCenter Syslog server that reaches arbitrary code execution from network access alone (QUIRSO, 2026-08-10). The timeline is the part that should reset patch priorities: "Compromised systems identified by QUIRSO were found to first establish contact with the attacker's domains on August 3, five days after Broadcom publicly disclosed the flaw" (The Hacker News, 2026-08-12). QUIRSO records 361 unique victim IP addresses across 47 countries, with Germany, the United States, Turkey, Iran and France the most affected and 185 of the 361 addresses in those five countries; it is explicit that an address does not correspond to an organisation, since some belong to hosting providers and shared infrastructure. By 5 August, 343 of the 361 addresses had already appeared, the campaign reached roughly 95 per cent of its observed footprint within three days of starting (QUIRSO, 2026-08-10). QUIRSO assesses that while the attacker might have had prior knowledge of the flaw, the correlation with disclosure suggests the advisory itself was the campaign's starting point.

Switzerland's NCSC updated its own VMSA-2026-0006 advisory on 12 August, setting "Current exploitation status: Actively Exploited" and citing QUIRSO's report (NCSC-CH, 2026-08-12).

What the attacker does after landing. The chain reported is path-traversal activity consistent with the flaw, "followed by the deployment of a malicious cron job to establish persistence on the host using reverse_ssh" (The Hacker News, 2026-08-12), an open-source SSH-based reverse-shell framework whose legitimate penetration-testing features include automatic connect-back, port forwarding and file transfer. The choice is a deliberate one about direction of travel: the control channel is established outbound from the appliance, which sidesteps controls built to stop unsolicited inbound access (QUIRSO, 2026-08-10). QUIRSO says a follow-up publication examining the attacker's tradecraft, infrastructure and post-exploitation activity is planned, and that further detection content is being released in coordination with law-enforcement partners.

A second, separate signal sits alongside it and should not be merged with the first. The Hacker News reports Defused Cyber observing a spike in scanning against vCenter (version probes and walks of the single-sign-on flow) that it associates with CVE-2026-59309, the unauthenticated Directory Service authentication bypass from the same advisory. QUIRSO's co-founder Denis Szadkowski told the outlet there is not enough evidence to correlate that scanning with the intrusion set behind CVE-2026-59310, adding that "the forensic evidence strongly points toward CVE-2026-59310 as the initial access vector" for the compromises QUIRSO investigated (The Hacker News, 2026-08-12). Two flaws in one advisory are drawing attention independently; only one has confirmed compromises behind it.

Detection concepts, telemetry class first. The behaviours worth hunting are all unusual for a management appliance rather than unusual in general. In egress and flow records, an SSH-protocol session initiated from a vCenter appliance to an external destination inverts the normal direction of vCenter traffic, which is inbound administrative access and outbound management of hosts. In configuration and scheduling state on the appliance, cron or scheduled entries that no platform-engineering change record accounts for are the persistence artefact reported here. In process telemetry, execution lineage descending from the Syslog service is the exploitation artefact. QUIRSO's own framing of the tool is the right calibration and applies to any dual-use binary: "The presence of reverse_ssh should not, by itself, be treated as proof of malicious activity.", "In combination with unauthorized installation, unexpected outbound connections or execution on a vulnerable vCenter appliance, however, it is a high-priority indicator requiring investigation." (QUIRSO, 2026-08-10)

Triage: administrators do legitimately place scheduled jobs on appliances and do run SSH from jump hosts, so neither artefact alone resolves. What separates this activity is the appliance being the SSH client toward an external network, a scheduled entry created outside a change window and not present in the platform team's configuration baseline, and either appearing on a vCenter whose build predates the VMSA-2026-0006 fixes. On an appliance patched before 29 July none of the three should be present at all.

CISA added CVE-2026-59310 to its Known Exploited Vulnerabilities catalog on 2026-08-18, a jurisdiction-agnostic confirmation of active exploitation, independent of any US-FCEB remediation deadline, layered on top of NCSC-CH's own actively-exploited determination already recorded above.

QUIRSO's continued work on the campaign this entry has tracked since 13 August now attributes the activity to a suspected China-nexus actor and reports that Babuk-derived ransomware was deployed against ESXi hosts in at least one investigated case (The Hacker News, 2026-08-17). Infosecurity Magazine reports the same assessment: "the digital forensics company assessed a suspected advanced persistent threat (APT) actor was responsible, counting 361 victim IP addresses across 47 countries" (Infosecurity Magazine, citing QUIRSO GmbH, 2026-08-14). The ransomware deployment (.babyk extension) is assessed by QUIRSO as plausibly a smokescreen rather than the operation's goal: the deployment of "the locker", the Babuk-derived payload, "may not have been the primary objective of the campaign" (The Hacker News, paraphrasing QUIRSO's assessment, 2026-08-17), plausibly intended to encrypt ESXi log files and hinder forensics rather than for extortion.

Both findings warrant the same caveat this entry already applies to the CVE-2026-59309 scanning correlation: every outlet surveyed (The Hacker News, Infosecurity Magazine, and further security-press pickup) cites QUIRSO's own Medium write-ups as the sole source for the China-nexus attribution (built on a UTC+08:00 activity pattern, Chinese-language code artefacts, and reuse of a Chinese security publication) at QUIRSO's own stated moderate confidence, and for the ransomware finding. Two outlets reporting one firm's conclusion is wide distribution of a single assessor's work, not independent corroboration of it; the attribution and the ransomware-deployment finding should be read as QUIRSO's own assessment, not as cross-verified intelligence, and are recorded here on that basis rather than folded into this entry's overall A/1 rating, which reflects the multi-CERT-corroborated vulnerability and initial-exploitation facts.

Nothing in this update changes the remediation guidance already given above: patch every internet-reachable vCenter to the fixed builds, and treat any instance that was internet-reachable and unpatched between 29 July and 3 August as a compromise-assessment candidate rather than a patch-and-close item, that assessment should now explicitly include a check for Babuk-derived (.babyk) file extensions on any ESXi hosts the appliance manages, alongside the reverse_ssh persistence and cron-entry artefacts already described.

The still-open ANCPI (Romanian National Agency for Cadastre and Real Estate Publicity) incident developed on two fronts. First, an impact contradiction: on 2026-07-20 ANCPI stated publicly, following completed security verification, that its technical and legal databases had not been affected (Digi24, 2026-07-20), squarely against extortion operator ByteToBreach's earlier claim, reported by Risky Business News, that the "hacker entered using valid credentials, mapped internal systems, and wiped systems and backups after failing to extort the agency" (Risky Business News, 2026-07-20). The agency frames the multi-day e-Terra/RENNS outage (down since 14 July) as deliberate protective isolation and says it is migrating applications to the Romanian Government Cloud, coordinated by the Special Telecommunications Service, expected to complete 22 July before any phased service restoration.

Second, actor context: KELA's updated profile assesses ByteToBreach is likely a single operator based in Oran, Algeria, active since June 2025 across forums, Dread, Telegram and a storefront, with a victim set spanning government, banking, airline and university targets across several countries, and access methods documented as cloud/corporate-infrastructure exploitation, reuse of infostealer/phishing-harvested credentials, and brute force (KELA, 2026-07-17).

The picture of the attack on ANCPI, Romania's national cadastre and land-registration agency, has changed substantially. Earlier coverage recorded the agency's own position that its databases were not affected. Romania's national cybersecurity directorate DNSC has since published an interim technical report, relayed with direct quotation by Romanian technology press, that supersedes that framing on the point that matters most: the attackers extracted approximately two million records concerning users of the payment platform, containing names, e-mail addresses, identifiers and password hashes, in the report's Romanian, "atacatorii au extras aproximativ două milioane de înregistrări privind utilizatori ai platformei de plăți, care conțineau: nume; e-mailuri; identificatori; hash-uri ale parolelor" (PS News, 2026-07-24). The "databases not affected" assurance survives only in a much narrower form; DNSC states there is no indication the main Oracle Exadata database was compromised (go4it.ro, 2026-07-24), which is a different claim from "no data was taken", since a separate payment-platform datastore demonstrably was.

The intrusion path DNSC describes is the one that makes a virtualized government estate fail all at once. Per the report the attackers compromised the authentication servers, penetrated VMware vCenter (the system administering the entire virtual infrastructure) enumerated all 1,083 virtual machines, executed lateral movement, deleted approximately 100 virtual machines and encrypted ESXi servers with ransomware (PS News, 2026-07-24). Identity compromise first, then the virtualization control plane, then destruction at the hypervisor layer beneath every guest operating system, the per-VM security stack never gets a vote. Source code for the eTerra, GIS, ePayment and security modules was taken from the agency's GitLab as well. DNSC's account of why it worked is unusually blunt for a national authority; the ANCPI infrastructure had no antivirus installed on the servers running its main applications (go4it.ro, 2026-07-24), alongside known unpatched vulnerabilities and a web-application firewall retaining connection logs for only seven minutes, which is also why the forensic picture is partial. DNSC's director had already assessed on 2026-07-18 that the attack exploited already-known vulnerabilities and could have been prevented (go4it.ro, 2026-07-18).

Triage: in vCenter and ESXi audit telemetry, the discriminating sequence is not any single administrative action but the ordering, an authentication from an unusual source or service account, followed by a full inventory enumeration of virtual machines, followed by power-off or delete operations across guests that share no application grouping. Routine administration enumerates inventory constantly and backup tooling touches many VMs, so volume alone is noise; the signal is enumeration by a principal that does not normally perform it, immediately followed by destructive operations spanning unrelated workloads.