Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

A compromised IP count is not an organization count. No named victim, reliable actor identity, ransomware link, or public complete IOC set is retained. Internet exposure is not required if another foothold can reach the management network, and internal placement alone does not prove isolation.

Reporting period

August 3–13, 2026; research cutoff August 16, 2026

Methodology

Reconciliation of the Broadcom advisory and FAQ, NVD/CVE/CISA status, and BleepingComputer's attributed QUIRSO telemetry

Sample scope

361 compromised IP addresses across 47 countries reportedly identified by QUIRSO by August 7; no named victim population

Claim status

Vulnerability facts vendor-controlled; exploitation timing, scale, geography, and reverse_ssh use source-bounded; actor and victim identity unknown

1. [1] VMSA-2026-0006.1Broadcom / VMware
2. [2] Critical VMware vCenter RCE flaw exploited for reverse SSH accessBleepingComputer
3. [3] CVE-2026-59310NIST NVD / VMware CNA