# China-Linked Hackers Turn New VMware Flaw Into Global Ransomware Campaign Within Days

*Monday, August 17, 2026 at 8:05 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-08-17T08:05:30.150Z (3h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/14731.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A suspected China‑nexus hacking group weaponized a newly disclosed VMware vCenter vulnerability in less than a week, deploying Babuk‑derived ransomware against ESXi servers tied to an estimated 361 IPs in 47 countries. The campaign shows how fast well‑resourced actors can convert enterprise software flaws into leverage over critical infrastructure and government networks worldwide. This report unpacks the exploit, the targets at risk and what the rush to ransomware says about state-linked cyber strategy.

A suspected China‑linked hacking group has turned a freshly disclosed VMware vCenter vulnerability into a global ransomware campaign in a matter of days, in a case that blurs the line between espionage and outright digital extortion against critical systems. Security researchers say the attackers began exploiting the flaw, tracked as CVE‑2026‑59310, only five days after it was made public. The vulnerability affects VMware vCenter, a widely used management platform for VMware’s ESXi virtualization environment, which underpins data centers for governments, telecoms, cloud providers and large enterprises. By moving so quickly, the group effectively weaponized a zero‑day‑adjacent window before many organizations had a chance to patch. According to technical reporting, the…

---

*Full article available with Hamer Intel Pro — https://hamerintel.com/pricing*