Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Suspected Chinese Hackers Turn VMware vCenter RCE Into Root Backdoors and ESXi Ransomware
Excerpt
A suspected Chinese-speaking threat actor has exploited a critical VMware vCenter Server vulnerability to gain root-level access, establish several backdoors, steal directory credentials, and deploy Babuk-derived ransomware on ESXi hypervisors. The campaign targeted CVE-2026-59310, a critical directory-traversal flaw in VMware vCenter’s Syslog Server that can allow remote code execution. Broadcom assigned the bug a CVSS score of 9.8 and disclosed it on July 29, 2026.…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-59309 | Medium | Score 44/100 | First seen |
| CVE | CVE-2026-59310 | High | Score 59/100 | First seen |
IOC Relationship Graph
Building graph…