Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware

Researchers have linked the exploitation of a severe vulnerability in VMware vCenter to a suspected China-nexus advanced persistent threat. The vulnerability, which has a high CVSS score, is a directory-traversal flaw that can be used to execute arbitrary code. A newly patched security flaw is being exploited in these attacks. The exploitation is part of an attack chain that involves deploying Babuk-derived ransomware. The vulnerability is considered severe and has been assigned an identifier. The flaw was recently patched by the vendor.