Search — “Warp Panda”

CrowdStrike reported that China-nexus actor Warp Panda exploited CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESXi (CVSS 2.7), as a zero-day in early 2026 to perform admin operations without being logged. Per the source, the actor targets internet-facing edge devices, pivots to vCenter to deploy BRICKSTORM and SharpStorm, and in some cases harvests cloud session tokens and registers rogue MFA devices. CISA added the CVE to KEV and FCEB agencies were told to patch by November 11, 2026. Hunters should look for gaps in ESXi/vCenter audit logging and for new MFA device registrations on M365 accounts.

CISA added CVE-2026-41709, a low-severity insufficient logging flaw in VMware ESXi, to its KEV catalog after CrowdStrike reported that the China-nexus actor Warp Panda exploited it as a zero-day in intrusions at US organizations, including law firms. Per CrowdStrike, Warp Panda typically gets initial access via internet-facing edge devices, pivots to vCenter, and used this CVE to significantly reduce audit trail visibility. Hunters should review ESXi and vCenter logging continuity and look for gaps in audit trails around administrator activity, since the flaw lets logged-in administrators act without being logged.

CrowdStrike attributes exploitation of CVE-2026-41709, a low-severity insufficient logging flaw in VMware ESXi, to the China-nexus actor Warp Panda, which used it as a zero-day in early 2026 to perform operations without audit logging. The reporting ties the activity to attacks on the US legal sector and says the actor also bypasses audit logging, harvests cloud session tokens, and registers rogue MFA devices. CISA added the CVE to the KEV catalog; defenders should review ESXi patch levels and look for gaps in ESXi and vCenter audit logs.

BeyondTrust patched CVE-2026-102764, a critical auth-bypass/file-operation zero-day in Remote Support (and shared PRA code) exploited since late August 2026 by suspected PRC-nexus actor ARMORY CASTLE (UNC5221/Warp Panda). Attackers uploaded the SAWFLY PHP webshell, escalated to root via a SUID-bit copy of /bin/sh, dumped the appliance credential vault with bt-secrets, added passwordless sudo persistence surviving reboot, deployed the BARECLAW SOCKS5 WebSocket tunneler via haproxy.conf changes, wiped logs, and abused Administrator sessions for lateral movement. Hunt for unknown .php POSTs, SUID binaries like /usr/bin/dbus-authd, sudoers.template changes, haproxy ACL routing, and Jump Item role escalations.

China-nexus espionage actor Armory Castle (formerly UNC5221/Warp Panda) exploited CVE-2026-102764, an improper origin validation flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. The actor staged the SAWFLY PHP webshell (mangoapi.php), escalated to root by planting a SUID copy of /bin/sh at /usr/bin/dbus-authd, and dumped the appliance vault with bt-secrets. It persisted through a post_boot.d script that edits the sudoers template, raised Jump Item roles to Administrator, tunneled traffic with BARECLAW behind a modified haproxy.conf (/uidchanarge), and deleted logs. Hunt for unknown .php POSTs and WebSocket paths at the reverse proxy, user_changed syslog events raising Jump Item roles, file-transfer sessions, and gaps in appliance syslog forwarding.