VMware Syslog Path Traversal Becomes Root RCE, Persistent SSH Access and ESXi Ransomware | #ransomware | #cybercrime

A fast-moving campaign is turning a VMware vCenter flaw into a route to full control of virtual infrastructure. Attackers are abusing CVE-2026-59310, a critical path traversal bug in the Syslog Server, to run commands as root without a normal login.

The activity moved from disclosure to widespread exploitation in days. QUIRSO mapped 361 affected IP addresses in 47 countries, with technology, research, education and telecommunications environments among the sectors exposed.

The scale illustrates why vCenter management systems are such attractive targets.

QUIRSO GmbH said in a report shared with Cyber Security News (CSN) that it investigated a compromise where the intrusion progressed from likely unauthenticated code execution to persistent access, account creation, ESXi control and ransomware.

Its researchers assess, with moderate confidence, that a Chinese-speaking actor is behind the CVE-2026-59310 campaign, but do not link it to a named group.

The first observed victim connection occurred on August 3, five days after the vendor advisory. By August 5, 343 of the eventual 361 observed victim IPs had appeared.

That compressed timeline follows the scanning surge reported after these critical VMware security flaws emerged, and leaves little margin for defenders to treat internet-facing management systems as routine servers.

Syslog Flaw Opens Root Access

The initial intrusion was tied to malformed cron files that appeared under /etc/cron.d, including a name that referenced the CVE and Syslog service.

There were no matching authentication events, while the commands ran as root. This strongly supports the finding that attackers used the Syslog path traversal to write content into a location where cron would execute it.

The technique turns a management appliance into a launch point. Scheduled jobs downloaded tools, ran shell commands and used temporary folders for staging.

In the broader attack chain, this root access also enabled a web shell and password-free administrator rights for a legitimate service account. The risk is consistent with how the vCenter Syslog vulnerability enables remote execution without requiring prior access.

The actor then created several layers of return access. A system service restarted a backdoor, while fake tasks using VMware-like names repeatedly enabled SSH and placed an attacker key in root’s authorized keys.

The same campaign installed a web shell, created vSphere administrator accounts and retrieved credentials from the local directory service.

Researchers also observed an SSH-based reverse-tunnelling utility that makes the compromised host initiate an outbound connection to the operator.

That can evade controls built mainly to block unsolicited inbound access. Its unauthorised presence, together with recurring cron activity or unexpected vCenter egress, warrants investigation rather than being dismissed as an administrator tool.

ESXi Encryption Raises Impact

After inventory discovery, the attackers created local administrator accounts on ESXi hosts and copied a ransomware executable, plus scripts, through the vSphere datastore browser.

The helper script stopped running virtual machines, launched the encryptor against VMFS volumes and removed the VMware high-availability agent. That sequence can turn one vCenter compromise into a widespread availability incident.

The payload used a Babuk-derived encryptor and changed affected data to a distinct new extension. Large VMDK files were only partially encrypted, with the first 512 MB targeted, but that can still make virtual machines unusable.

The use of this ransomware family alone is not reliable attribution, a useful distinction amid other ESXi ransomware attacks that also target shared virtual-disk storage.

Defenders should apply the relevant vCenter updates immediately because no workaround replaces patching.

They should also remove direct public access to management interfaces, restrict administration to approved networks, review new accounts and sudoers changes, and examine cron, service and web-application directories for the listed signs.

This is especially urgent while attackers scanning VMware vCenter systems following disclosure.

Threat hunters should scan vCenter appliances for unauthorized remote-access and backdoor tools using available YARA content, then correlate any match with unexpected outbound connections and file or task creation.

Organizations that find these traces should treat the appliance and reachable ESXi estate as potentially compromised, preserve logs before cleanup, rotate exposed credentials and begin incident response.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world