# WARP PANDA

> As of 2026-10-29, WARP PANDA is a China-nexus threat actor tracked by Threadlinqs Intelligence across 6 threats spanning apt, malware, vulnerability. ATT&CK coverage spans 81 techniques across 15 tactics in 6 of 6 tracked threats. Most-observed techniques: T1190 (Exploit Public-Facing Application), T1572 (Protocol Tunneling), T1027 (Obfuscated Files or Information).

- **Nation:** China
- **Tracked threats:** 6
- **Categories:** APT, MALWARE, VULNERABILITY, ZERO_DAY
- **As of:** 2026-10-29

## ATT&CK techniques observed

81 techniques observed across 6 of 6 tracked threats. Tactics: Stealth (formerly Defense Evasion) (12), Command and Control (10), Persistence (9), Collection (7), Credential Access (7), Lateral Movement (7).

- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 6 of 6 tracked threats
- [T1572](https://intel.threadlinqs.com/technique/T1572) Protocol Tunneling — Command and Control — observed in 6 of 6 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 4 of 6 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 4 of 6 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 4 of 6 tracked threats
- [T1090](https://intel.threadlinqs.com/technique/T1090) Proxy — Command and Control — observed in 4 of 6 tracked threats
- [T1505](https://intel.threadlinqs.com/technique/T1505) Server Software Component — Persistence — observed in 4 of 6 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 3 of 6 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 3 of 6 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 3 of 6 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 3 of 6 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 3 of 6 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 3 of 6 tracked threats
- [T1685](https://intel.threadlinqs.com/technique/T1685) Disable or Modify Tools — Defense Impairment — observed in 3 of 6 tracked threats
- [T1003.003](https://intel.threadlinqs.com/technique/T1003.003) OS Credential Dumping: NTDS — Credential Access — observed in 2 of 6 tracked threats

## Tracked threats

- [China-nexus WARP PANDA exploits VMware ESXi insufficient-logging flaw (CVE-2026-41709) against law firms](https://intel.threadlinqs.com/threat/TL-2026-4740) — HIGH
- [VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign — MSP Supply-Chain Compromise of Edge Appliances with 18-Month Dwell](https://intel.threadlinqs.com/threat/TL-2026-0706) — CRITICAL
- [BRICKSTORM Backdoor: UNC5221 PRC-Nexus APT Targeting VMware vSphere Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-0313) — CRITICAL
- [CVE-2025-53521: F5 BIG-IP APM Unauthenticated Remote Code Execution via Stack-based Buffer Overflow](https://intel.threadlinqs.com/threat/TL-2026-0307) — CRITICAL
- [Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 GRIMBOLT Backdoor (CVE-2026-22769)](https://intel.threadlinqs.com/threat/TL-2026-0194) — CRITICAL
- [Dell RecoverPoint for VMs Zero-Day (CVE-2026-22769) — CVSS 10.0, PRC-Nexus UNC6201/Silk Typhoon, BRICKSTORM/GRIMBOLT/SLAYSTYLE, VMware Ghost NIC Pivoting, iptables SPA](https://intel.threadlinqs.com/threat/TL-2026-0123) — CRITICAL

## Related CVEs

5 CVEs referenced by tracked WARP PANDA activity.

- [CVE-2026-41709](https://intel.threadlinqs.com/cve/CVE-2026-41709)
- [CVE-2026-22769](https://intel.threadlinqs.com/cve/CVE-2026-22769)
- [CVE-2025-53521](https://intel.threadlinqs.com/cve/CVE-2025-53521)
- [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887)
- [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/WARP%20PANDA