China-Linked Warp Panda Used VMware ESX Zero-Day to Hide Its Tracks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a flaw in Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog. The move followed a CrowdStrike report that a China-nexus group called Warp Panda had used the bug in attacks on the U.S. legal sector.

The flaw is tracked as CVE-2026-41709 and carries a CVSS score of only 2.7. It is an insufficient logging issue: an attacker with admin access can perform certain operations without them being recorded in the logs. Broadcom released fixes back in July 2026. They shipped in updates to VMware Cloud Foundation (including version 5.2.4), VMware vSphere Foundation, VMware ESX and VMware Telco Cloud Platform.

A zero-day for covering tracks

According to CrowdStrike's 2026 Legal Threat Landscape Report, Warp Panda exploited CVE-2026-41709 as a zero-day in early 2026. The goal was to reduce audit trail visibility. The researchers say the group breaks into internet-facing edge devices using zero-days and custom malware, then maintains covert, persistent access. To evade detection, it bypasses audit logging, harvests cloud session tokens and registers rogue multi-factor authentication devices.

The group is also tracked as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo. It has a long record of exploiting zero-days in Citrix NetScaler and Ivanti Connect Secure appliances. Earlier in October, Google-owned Mandiant linked it to attacks through a critical flaw in BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.3). That flaw was used to deliver the SAWFLY and BARECLAW malware families.

How the attacks work

After gaining initial access through edge devices, Warp Panda pivots into VMware vCenter environments. There it deploys custom tools such as BRICKSTORM and SharpStorm to stay quietly entrenched. In some intrusions, the attackers also went after cloud services and extracted user session tokens. These let them access Microsoft 365 environments without triggering credential-based alerts. In at least one case, the group registered a new MFA device on a compromised account to keep access even after a password change.

CrowdStrike describes Warp Panda as a sustained, strategically focused cyber espionage threat to U.S. organizations across multiple sectors. In the company's view, law firms are especially attractive to a state-directed adversary. They hold client communications, merger and acquisition materials, active litigation strategy and access spanning many clients at once.

Given the active exploitation of CVE-2026-41709, U.S. Federal Civilian Executive Branch (FCEB) agencies are advised to apply the fixes by November 11, 2026.

Source: The Hacker News