Ransomware Escalates as Clop and Babuk Target Global Enterprises

The Ransomware Landscape Intensifies in 2026

The ransomware threat landscape has entered a particularly dangerous phase in August 2026, with multiple high-profile campaigns targeting global corporations, critical infrastructure, and healthcare institutions simultaneously. From suspected state-aligned APT groups exploiting zero-day vulnerabilities in VMware infrastructure to the notorious Clop ransomware gang claiming breaches at Fortune 500 companies, the breadth and sophistication of these attacks demand urgent attention from security professionals and business leaders alike.

Three distinct ransomware campaigns have dominated cybersecurity headlines this month, each illustrating a different facet of the evolving threat. Together, they paint a picture of an ecosystem where ransomware operators are becoming more strategic, more patient, and far more destructive.

Clop Ransomware Targets Shell, Philips, and GE

The Russia-linked ransomware group Cl0p has claimed responsibility for breaching nearly 50 global corporations, including oil giant Shell, health technology leader Philips, and General Electric. According to the group’s public claims, it exfiltrated approximately 89 gigabytes of material from Shell alone, including technical drawings, facility images, scans of test reports, and project plans. From Philips, the group says it stole an additional 13.5 gigabytes of diagrams and blueprints.

Both companies have confirmed they are investigating the claims. Shell stated it is aware of a possible incident, while Philips reported it had identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data. A Philips spokesperson indicated the incident is under control and has no impact on customers.

Security researchers have traced the campaign to a vulnerability in Windchill, engineering software made by American firm PTC. The flaw was patched on June 17, but the gap between patch availability and enterprise deployment proved wide enough for Cl0p to exploit at scale. Cl0p, active since 2019, is believed to have extorted upwards of $500 million from victims worldwide using its double-extortion model: stealing data first, then threatening public release if ransom demands are not met.

This incident underscores a sobering reality about supply chain security. As TNW editor-in-chief Ana-Maria Stanciuc observed, when enough of the corporate world standardises on the same enterprise platform, one shared supplier quietly becomes everyone’s single point of failure, and no amount of internal security spending can fully patch a hole in someone else’s code.

China-Nexus APT Deploys Babuk-Derived Ransomware via VMware vCenter

In a separate and equally alarming campaign, cybersecurity researchers have attributed the exploitation of a critical VMware vCenter vulnerability to a suspected China-nexus advanced persistent threat actor. The attacks center on CVE-2026-59310, a severe directory-traversal vulnerability with a CVSS score of 9.8 that allows remote code execution on affected vCenter servers. Broadcom released a patch on July 29, 2026, but exploitation began within five days of public disclosure.

German incident response firm QUIRSO assessed with moderate confidence that the operation is run by a Chinese-speaking threat actor working within the UTC+08:00 time zone. Their assessment is based on Chinese-language artifacts in attacker scripts, reuse of research from Chinese security publications, operational use of Chinese-language management tools, and a victimology pattern that deliberately excludes mainland China.

The campaign is estimated to have compromised 361 unique victim IP addresses across 47 countries, with the highest concentration of infections in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). The attackers exploited both CVE-2026-59310 and CVE-2026-59309, an authentication bypass flaw, to establish deep persistence within compromised environments.

Sophisticated Attack Chain

The attack chain demonstrates remarkable sophistication. After gaining initial access through the vCenter vulnerability, the threat actor deployed a custom backdoor called linuxFile that communicates with its command-and-control server over WebSocket channels. The C2 address is XOR-obfuscated and decoded at runtime, with communications protected by the malware’s own application-layer cryptography.

The attackers created fake cron jobs impersonating legitimate VMware services to maintain persistence. They deployed JSP web shells, stole vCenter directory service credentials, created rogue administrator accounts, and even modified sudoers configurations to grant unrestricted root access to compromised service accounts. The ultimate payload was a Babuk-derived ransomware that encrypts ESXi host files with the .babyk extension.

Notably, QUIRSO researchers suspect the ransomware deployment may not have been the campaign’s primary objective. Instead, it appears to have been used as a smokescreen to encrypt ESXi log files and destroy forensic evidence that could have revealed the full extent of the intrusion.

Gunra Ransomware Gang Exploits Fortinet Flaws and Bypasses MFA

Adding to the mounting concerns, the Gunra ransomware gang has been observed exploiting vulnerabilities in Fortinet products and successfully bypassing multi-factor authentication protections. This development is particularly troubling because MFA has long been considered a foundational security control, and its circumvention represents a significant escalation in attacker capabilities. The Gunra campaign highlights how ransomware operators are continuously refining their techniques to defeat even well-implemented security measures.

Common Themes and Emerging Patterns

Several patterns emerge from these concurrent campaigns that security teams should heed:

• Rapid exploitation of newly disclosed vulnerabilities — The China-nexus actor began exploiting CVE-2026-59310 within five days of public disclosure. Organizations that cannot patch within days of a critical vulnerability announcement are effectively operating with a target on their back.
• Supply chain convergence as an attack vector — The Cl0p campaign against Shell, Philips, and GE demonstrates how a single vulnerability in widely deployed enterprise software can become a gateway to dozens of major corporations simultaneously.
• Ransomware as a distraction — The Babuk-derived deployment in the VMware campaign appears designed to destroy forensic evidence rather than generate ransom payments, blurring the line between financially motivated crime and intelligence operations.
• Targeting of virtualization infrastructure — VMware vCenter and ESXi hosts are increasingly attractive targets because compromising a single vCenter server can provide access to every virtual machine in an organization’s environment.
• MFA is no longer sufficient on its own — The Gunra gang’s ability to bypass multi-factor authentication underscores the need for layered, defense-in-depth strategies.

Building Resilience Against Modern Ransomware

Organizations must adopt a multi-layered approach to ransomware defense that addresses both the initial access vectors and the post-exploitation techniques that these campaigns demonstrate.

Patch Management and Vulnerability Response

The speed at which attackers weaponize newly disclosed vulnerabilities means that traditional monthly patching cycles are no longer adequate. Organizations should implement risk-based patching programs that prioritize critical infrastructure components like vCenter servers, VPN appliances, and other internet-facing systems. Automated vulnerability scanning and continuous threat intelligence monitoring can help identify exposure before attackers do.

Identity and Access Hardening

Given the attackers’ focus on creating rogue administrator accounts and bypassing MFA, organizations should implement privileged access management solutions, enforce least-privilege principles, and monitor for anomalous account creation activities. Service accounts, in particular, should be audited regularly for unnecessary privileges and passwordless or phishing-resistant authentication should be deployed for high-value targets.

Immutable Backups and Recovery Planning

Ransomware operators increasingly target backup systems to eliminate recovery options. Organizations should maintain immutable, air-gapped, or cloud-based backups that cannot be modified or deleted by attackers. Regular recovery testing is essential to ensure that backups can be restored quickly in an actual incident.

Supply Chain Risk Management

The Cl0p campaign illustrates how third-party software vulnerabilities can become organizational vulnerabilities. Security teams should maintain an inventory of all enterprise software, track vendor security advisories, and assess the concentration risk associated with relying on single vendors for critical business functions.

Threat Detection and Incident Response

Given the sophistication of modern ransomware operations, organizations need continuous monitoring capabilities that can detect the lateral movement, persistence mechanisms, and credential theft activities that precede encryption. Security teams should be trained to recognize the indicators of compromise associated with campaigns like these, including unexpected cron jobs, rogue administrator accounts, and anomalous WebSocket connections.

The Road Ahead

The ransomware ecosystem in 2026 is characterized by professionalization, convergence with state-aligned operations, and an increasing willingness to target critical infrastructure. The simultaneous campaigns against Shell, Philips, GE, and hundreds of VMware vCenter servers demonstrate that no organization is too large or too well-defended to be targeted.

However, organizations that invest in rapid vulnerability response, robust identity protection, immutable backups, and proactive threat detection can significantly reduce their risk. The key lesson from this month’s attacks is clear: ransomware defense is no longer just about preventing encryption. It is about detecting and disrupting the full attack chain before attackers reach their objectives, whatever those objectives may be.

As threat actors continue to evolve their tactics, the security community must match that evolution with equally adaptive defenses. The cost of preparedness will always be less than the cost of a breach.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous