CVE-2026-59310 VMware vCenter Global Exploitation Campaign
Indicators of Compromise
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
REMEDIATION
DETECTION
T-Code | MITRE ATT&CK Technique | Technique Name | Detection Signal | Detection Strategy |
|---|---|---|---|---|
Exploit Public-Facing Application | Exploit Public-Facing Application | Monitor HTTP requests to VMware vCenter matching directory-traversal patterns associated with CVE-2026-59310. Alert on requests resulting in root-level code execution logged by crond. Detect abnormal request patterns, elevated 4xx/5xx errors, and unusual HTTP methods/paths. Chain: suspicious request → elevated errors → server process spawns shell → optional outbound callback | DET0080 - Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress) - https://attack.mitre.org/detectionstrategies/DET0080/ | |
Scheduled Task/Job - Cron | Scheduled Task/Job - Cron | Detect creation or modification of files under /etc/cron.d/ on vCenter Server Appliances. Alert on files with names mimicking VMware service conventions: 'vmware-vpxd-stats-', 'vmware-perf-collect-', 'vmware-perf-sync-*', or containing CVE identifiers like 'zz-poc59310'. Monitor for malformed cron entries and curl | sh pipe execution patterns | Monitor crontab file modifications; detect vmware-* cron pattern anomalies; alert on cron jobs executing shells with network access; track malformed cron entries | |
Server Software Component - Web Shell | Server Software Component - Web Shell | Alert on JSP file creation in VMware web-accessible directories, specifically files named 'vmware-perf-update.jsp' or unexpected JSP files placed by cron jobs. Monitor for Base64-encoded JSP content in system logs. Track unexpected file writes to /usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/ | Monitor JSP file creation in web directories; detect suspicious file transfers to Tomcat web paths; alert on Base64 encoding/decoding of web shells; track file writes to Perfcharts directories | |
Create Account - Local Account | Create Account - Local Account | Detect creation of new local accounts on ESXi hosts or vCenter outside of approved provisioning workflows. Target accounts: 'adminuser', 'vcadmin', 'vcenter_admin', 'svc_*'. Alert on accounts subsequently added to vSphere SSO Administrators group. Monitor shadow file modifications and account creation events | Alert on unexpected account creation via useradd/passwd; monitor /etc/passwd and /etc/shadow modifications; detect accounts added to privileged groups immediately after creation; track account naming patterns | |
Account Manipulation - Modify Groups | Account Manipulation - Modify Groups | Alert on accounts being added to vSphere SSO Administrators group or vSphere admin roles via REST API. Monitor LDAP 'Add' operations against vmdir. Track Base64-encoded Python scripts executed via bash that modify group membership. Detect rapid group membership changes from internal LDAP service | Monitor LDAP "Add Entry" operations to Administrators groups; track group membership changes in vmdir logs; alert on SSO group modifications from internal processes; detect unauthorized group modifications | |
Valid Accounts - Cloud Accounts | Valid Accounts - Cloud Accounts | Detect logins or API calls originating from newly created administrative accounts (e.g., 'vcenter_admin', 'adminuser', 'svc_*') where no prior legitimate login history exists. Monitor SSO authentication events and vSphere API access patterns from new accounts. Alert on first-time authentications from newly provisioned accounts | Track first-time login events from newly created accounts; monitor vSphere API call volumes from dormant accounts; alert on REST API usage with new service account credentials; detect anomalous access patterns | |
System Information Discovery | System Information Discovery | Alert on vSphere REST API discovery calls using anomalous User-Agent strings such as 'GoodMoodle-VCFleet/1.0' or 'GoodMoodle-VCProbe/1.0' when issued from external or unexpected IP addresses. Monitor for systematic queries to datacenter, cluster, host, VM, datastore, and network endpoints. Track GET requests to /rest/vcenter/* paths | Detect unusual User-Agent strings in vCenter access logs; monitor REST API calls targeting /rest/vcenter/* endpoints from non-standard clients; alert on rapid sequential API discovery calls; track API enumeration patterns | |
File and Directory Discovery | File and Directory Discovery | Monitor for repeated file system queries and directory traversals on vCenter and ESXi systems, particularly targeting sensitive paths: /opt/likewise/, /etc/cron.d/, /tmp/, /var/tmp/. Detect systemd service discovery and configuration file enumeration. Track unusual file access patterns | Monitor system call traces for file stat/open operations on sensitive paths; detect directory traversal patterns in access logs; alert on enumeration of /etc and /opt directories from unusual processes; track recursive directory scans | |
Unsecured Credentials - Private Keys | Unsecured Credentials - Private Keys | Detect shell script execution that queries HKEY_THIS_MACHINE\services\vmdir registry location to harvest vCenter machine account credentials. Monitor for VMware vmafd Python module invocations: GetMachineName(), GetMachinePassword(), GetDomainName(). Track credential file creation and LDAP authentication attempts using harvested credentials | Alert on lwregshell command execution with registry queries; detect Python vmafd module instantiation; monitor credential file creation (/tmp/.ldappw); detect LDAP authentication attempts using harvested credentials; track registry access patterns | |
Obfuscated Files or Information | Obfuscated Files or Information | Alert on execution of Base64-encoded scripts or XOR-obfuscated binaries on vCenter appliances. Detect where decoded content establishes WebSocket C2 connections or modifies sudoers files granting passwordless root access. Monitor for base64 encoding/decoding activity and obfuscated payload execution | Detect base64 decoding operations piped to shell/bash; monitor for `echo | |
Remote Services - SSH | Remote Services - SSH | Detect outbound WebSocket connections (ws://) from vCenter Server Appliances to external hosts, especially on non-standard ports (ws://intel.se9ly9upbhay.shop:8080/ws). Monitor for reverse_ssh process execution and malicious SSH key installation. Alert on persistent reverse SSH tunnels | Monitor outbound SSH connections (TCP/22) and non-standard SSH tunnels from vCenter; detect reverse SSH process spawning; alert on SSH key additions to authorized_keys files; track WebSocket connections from vCenter; detect SSH tunnel persistence | |
Process Discovery | Process Discovery | Monitor for enumeration of running processes using ps, /proc examination, or process introspection tools. Detect discovery of legitimate VMware services (vpxd, vmafd, perfcharts) and attempts to identify security software. Track unusual process discovery patterns | Alert on process enumeration via ps aux or /proc/*/cmdline access; detect process discovery tools (pstree, procps); monitor process listing frequency and volume from administrative tools; track discovery of specific VMware services | |
Create or Modify System Process - Systemd Service | Create or Modify System Process - Systemd Service | Detect creation of new systemd services with suspicious names: 'sys-9436d8.service', 'network-manager'. Alert on services that execute arbitrary binaries from unusual paths like /root/.local/share/ directories. Monitor systemd unit file creation and modifications | Alert on systemd unit file creation in /etc/systemd/system/; detect service enables and starts of suspicious services; monitor ExecStart paths for binaries in hidden directories; track service configuration changes; detect service restart behavior | |
Abuse Elevation Control Mechanism - Sudo/Su | Abuse Elevation Control Mechanism - Sudo/Su | Alert on modification of sudoers configuration files (/etc/sudoers.d/vmware-perf) that grant passwordless root access to service accounts (perfcharts). Monitor sudoers file write events and configuration parsing errors. Detect Defaults:* NOPASSWD entries | Detect sudoers file modifications via visudo or direct writes; monitor for Defaults:* no-password entries; alert on sudoers entries allowing service account root execution; track sudo usage from affected service accounts; detect privilege escalation via sudo | |
Indicator Removal on Host - File Deletion | Indicator Removal on Host - File Deletion | Detect rapid deletion of scripts and malicious cron jobs post-execution. Monitor for unlink/rm system calls on specific file paths: /etc/cron.d/zz-poc59310*, /tmp/.* files. Alert on forensic artifact cleanup | Alert on file deletion of suspicious cron entries; monitor rm/unlink syscalls targeting /etc/cron.d/; detect deletion of /tmp/.* files containing Base64 content; track deletion patterns indicating cleanup activity; monitor file deletion frequency spikes | |
Application Layer Protocol - Web Protocols | Application Layer Protocol - Web Protocols | Monitor for anomalous HTTP/HTTPS traffic to external IPs and domains: 5.34.177.38:9861, 185.144.28.120:3232, intel.se9ly9upbhay.shop, profound-beijinho-504b1f.netlify.app performing payload downloads. Detect curl/wget usage with suspicious options (-L, -o, -fsSL) | Alert on HTTP GET/POST to malicious domains; detect curl/wget commands with redirection flags; monitor for large file downloads from attacker infrastructure; track WebSocket protocol usage; detect protocol tunneling attempts | |
Ingress Tool Transfer | Ingress Tool Transfer | Detect curl and wget commands downloading executables from attacker-controlled infrastructure: http://5.34.177.38:9861/linuxFile, http://185.144.28.120:3232/esxi.sh, https://tmpfiles.org/, https://profound-beijinho-504b1f.netlify.app/. Monitor file transfer operations bypassing security controls | Alert on curl/wget for binary downloads; monitor file transfer tool usage (sftp, scp, rsync); detect downloads to /tmp/ and other staging directories; track file transfer to/from suspicious IPs; detect tool staging patterns | |
Native API | Native API | Monitor for direct use of vSphere API calls (SOAP, REST) for discovery and account manipulation. Detect calls to vCenter SDK functions: RetrieveServiceContent, CreateContainerView, Login from unauthorized clients. Track vCenter COM/WMI API usage patterns | Alert on direct vSphere API calls from non-standard clients; monitor for CreateContainerView and Fetch operations; track vCenter COM/WMI API usage patterns; detect SDK method invocations from shell scripts; monitor API call sequences | |
Modify Authentication Process - Auth Plugins | Modify Authentication Process - Auth Plugins | Monitor for modification of authentication handlers and policy settings in vCenter's vmafd service and vmdir LDAP directory. Detect changes to authentication mechanisms enabling account creation and privilege escalation. Alert on authentication policy modifications | Alert on vmdir configuration changes; monitor LDAP schema modifications; detect authentication handler registration changes; track policy modifications enabling unauthorized access; monitor authentication bypass configurations | |
Impair Defenses - Disable or Modify Tools | Impair Defenses - Disable or Modify Tools | Detect removal of vSphere High Availability agent (vmware-fdm VIB removal) and other defensive mechanisms. Monitor for esxcli software vib remove commands targeting security-related packages. Track disabling of security features | Alert on VIB (vSphere Installation Bundle) removal operations; monitor for esxcli commands disabling security features; detect execInstalledOnly setting disabled; track removal of security agents; monitor defensive tool removal | |
Hide Artifacts - Hidden Files and Directories | Hide Artifacts - Hidden Files and Directories | Detect creation and use of hidden files and directories (files prefixed with dots) to conceal malicious activity: .x/, .vmware-perf-*, .ldappw, .sso_domain. Monitor for reduced visual visibility during casual inspection. Track hidden file creation patterns | Alert on creation of dot-prefixed files in /tmp/; monitor for hidden directory enumeration; detect access patterns to hidden files from non-standard processes; track hidden file enumeration; monitor hidden file modification timestamps | |
Masquerading | Masquerading | Detect use of fake VMware service names in cron jobs: vmware-vpxd-stats-, vmware-perf-collect-, vmware-perf-sync-* and User-Agent impersonation: GoodMoodle-VCProbe, GoodMoodle-VCFleet. Monitor for naming anomalies in scheduled tasks and suspicious User-Agent strings | Alert on cron jobs with vmware-* prefixes; detect User-Agent strings impersonating legitimate tools; monitor for naming conventions mimicking system processes; track fake service names in systemd/cron; detect legitimate service impersonation | |
Modify Registry | Modify Registry | Detect registry modifications to vCenter machine account registry: HKEY_THIS_MACHINE\services\vmdir during credential harvesting. Monitor for registry query and write operations targeting sensitive keys. Alert on registry tampering | Alert on registry reads/writes to vmdir registry keys; monitor lwregshell invocations; detect registry queries from non-standard processes; track HKEY_THIS_MACHINE modifications; monitor registry access frequency | |
Data Encrypted for Impact | Data Encrypted for Impact | Detect ransomware encryption activity on VMFS volumes using Babuk-derived malware (.babyk extension). Monitor for large-scale file encryption operations and partial VMDK encryption patterns (512 MB chunks). Alert on mass encryption activity | Alert on mass file creation with .babyk extension; detect VMDK partial encryption (512 MB chunks); monitor ransomware process behavior; track file rename/encryption patterns on datastores; detect encryption-related process spawning | |
Inhibit System Recovery | Inhibit System Recovery | Detect removal of vmware-fdm (VMware Fault Domain Manager) and other recovery mechanisms. Monitor for esxcli commands disabling High Availability functionality. Alert on removal of system resilience features | Alert on esxcli vib remove operations targeting recovery components; detect HA agent removal; monitor for system recovery mechanism disabling; track system resilience feature removal; detect failover mechanism impairment |