<![CDATA[VMware vCenter Exploit Turns Into Babuk Ransomware Attack on ESXi]]>

<![CDATA[VMware vCenter Exploit Turns Into Babuk Ransomware Attack on ESXi]]>A suspected China-nexus actor reportedly exploited CVE-2026-59310 only 5 days after disclosure, compromising an estimated 361 IPs across 47 countries.

The attack chain reportedly went from:

vCenter → Root Access → Credential Theft → ESXi → Babuk-derived ransomware

The interesting part is how the attackers turned a vCenter compromise into control of the underlying virtualization infrastructure.

I broke down the full attack chain, persistence mechanisms, credential harvesting, ESXi lateral movement, and ransomware deployment.

]]>https://forum.ieu.app/topic/2fd063f9-a97c-4496-825a-aa89b965febd/vmware-vcenter-exploit-turns-into-babuk-ransomware-attack-on-esxiRSS for NodeSat, 05 Sep 2026 18:16:13 GMTMon, 17 Aug 2026 08:37:41 GMT60