Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Threat actors are actively exploiting a recently patched critical vulnerability (CVE-2026-59310) in Broadcom VMware vCenter to gain persistent remote access. QUIRSO discovered a campaign involving 361 unique victim IP addresses across 47 countries, primarily in Germany, the U.S., Turkey, Iran, and France. The campaign involved a successful compromise, with evidence strongly suggesting CVE-2026-59310 as the initial access vector, and a correlation with previous VMware exploitation campaigns by Chinese APT actors.