Threat reportAPTTL-2026-4740
China-nexus WARP PANDA exploits VMware ESXi insufficient-logging flaw (CVE-2026-41709) against law firms
China-nexus WARP PANDA exploits VMware ESXi (TL-2026-4740), also tracked as BRICKSTORM, is a high-severity advanced persistent threat campaign scored CVSS 2.7, first published 2026-10-29. It is attributed to WARP PANDA (China) with medium confidence, affects Broadcom/VMware VMware ESX/ESXi, references 1 CVE (CVE-2026-41709), maps to 19 MITRE ATT&CK techniques (T1003.003, T1021.004, T1036.004), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 2.7/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 1WARP PANDA
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4740
- Threat ID
- TL-2026-4740
- Also known as
- BRICKSTORM, Junction, GuestConduit
- Severity
- HIGH
- CVSS
- 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- WARP PANDA
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- legal, technology, manufacturing
- Target regions
- North America, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in China-nexus WARP PANDA exploits VMware ESXi
Malware and tooling: BRICKSTORM - S9015, GuestConduit, Junction, 7-Zip (ESXi-compatible build), JSP web shell
How China-nexus WARP PANDA exploits VMware ESXi works
China-nexus adversaries led by WARP PANDA are reported (via CrowdStrike's 2026 Legal Threat Landscape reporting) targeting law firms for espionage using BRICKSTORM backdoors and JSP web shells. CVE-2026-41709, an ESXi insufficient-logging flaw added to CISA KEV on 2026-10-28, lets an administrator-level attacker perform operations without them being logged.
GBHackers (2026-10-29) summarizes CrowdStrike's 2026 Legal Threat Landscape Report, which covers 2025-09-01 to 2026-08-31. It states China-nexus actors target U.S. law firms for cyber espionage, naming WARP PANDA (VMware ESXi/vCenter intrusions with BRICKSTORM backdoors and JSP web shells, continuing into early 2026), TITAN PANDA (April 2026 exploitation of a hardcoded IIS machine key in Intapp Time Server), MURKY PANDA (ORB28 password-spraying campaign hitting 340+ organizations) and OVERCAST PANDA (targeting of U.K. legal-firm executives in Sept-Oct 2025). The article says CVE-2026-41709 allows attackers to bypass command logging in ESXi, reducing defender visibility post-compromise. The link between WARP PANDA and this specific CVE rests on that secondary article; the primary CrowdStrike legal report was not retrievable.
Vendor facts (Broadcom VMSA-2026-0006, published 2026-07-29, updated 2026-08-19): CVE-2026-41709 is an ESX insufficient-logging vulnerability; a malicious administrator can perform certain operations without them being logged. CVSS 3.1 base score is 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). No workarounds exist. The reporter credited is Ian Barton of CrowdStrike. Per the NVD-derived mirror, it was added to CISA KEV on 2026-10-28 with a remediation deadline of 2026-11-11. Because exploitation needs high privileges, it is a post-compromise defense-evasion enabler, not an initial-access bug. The HIGH severity rating on this record is an analyst assessment based on confirmed exploitation and nation-state use, not the vendor score of 2.7.
WARP PANDA tradecraft documented by CrowdStrike (Aug 2025 blog) provides the behavioral context. BRICKSTORM runs on vCenter and masquerades as vCenter processes (updatemgr, vami-http). It uses WebSockets over TLS with nested TLS channels, resolves C2 over DNS-over-HTTPS, and uses Cloudflare Workers and Heroku infrastructure. The Golang ESXi implant Junction listens on TCP 8090 (mimicking vvold) and offers command execution, proxying and VM socket communication. The Golang guest-VM implant GuestConduit opens a VSOCK listener on port 5555 for traffic tunneling. The actor moves laterally over SSH using the vpxuser account and SFTP, clears logs, timestomps files, and creates unregistered VMs that are later shut down. It clones domain controller VMs to reach Active Directory databases, uses an ESXi-compatible 7-Zip to read thin-provisioned snapshots, and abuses Microsoft 365 with stolen session tokens, new MFA device registration, and Graph API enumeration. Initial access in the documented intrusions came from edge and virtualization flaws: Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887), F5 BIG-IP (CVE-2023-46747) and vCenter (CVE-2021-22005, CVE-2023-34048, CVE-2024-38812).
MITRE ATT&CK techniques used in TL-2026-4740
Credential Access
T1003.003 OS Credential Dumping: NTDS
Lateral Movement
T1021.004 Remote Services: SSH; T1550.001 Use Alternate Authentication Material: Application Access Token
Defense Evasion
T1036.004 Masquerading: Masquerade Task or Service; T1070.004 Indicator Removal: File Deletion; T1070.006 Indicator Removal: Timestomp; T1564.006 Hide Artifacts: Run Virtual Instance
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1572 Protocol Tunneling
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application
Persistence
T1098.005 Account Manipulation: Device Registration; T1505.003 Server Software Component: Web Shell
Collection
T1114.002 Email Collection: Remote Email Collection; T1213.002 Data from Information Repositories: Sharepoint; T1530 Data from Cloud Storage; T1560.001 Archive Collected Data: Archive via Utility
defense-impairment
Affected products and versions in China-nexus WARP PANDA exploits VMware ESXi
- Broadcom/VMware — VMware ESX/ESXi
Vulnerable versions: ESX 8.0; ESX 9.0.x.x; ESX 9.1.x.x; VMware Cloud Foundation ESX 5.x; Telco Cloud Platform ESX 5.0.x/5.1.x
Fixed in: ESXi-9.1.0.0-25370933; ESXi-9.0.2.0100-25595025; ESXi80U3j-25429389; VCF 5.2.4; Telco Cloud Platform KB449886
Remediation for China-nexus WARP PANDA exploits VMware ESXi
Patches
- ESXi-9.1.0.0-25370933
- ESXi-9.0.2.0100-25595025
- ESXi80U3j-25429389
- VMware Cloud Foundation 5.2.4
- Telco Cloud Platform KB449886
Immediate actions
- Patch ESXi to a fixed build listed in VMSA-2026-0006 (ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389)
- Meet the CISA KEV remediation deadline of 2026-11-11
- Restrict and audit ESXi/vCenter administrator accounts and SSH access, including the vpxuser account
- Hunt for unregistered VMs, listeners on TCP 8090 and VSOCK 5555, and processes named updatemgr or vami-http outside expected paths
Workarounds
- None available per Broadcom VMSA-2026-0006
Longer-term hardening
- Forward ESXi and vCenter logs to an external SIEM in real time so local logging gaps cannot hide admin activity
- Isolate management interfaces of ESXi and vCenter from user and internet networks
- Monitor Microsoft 365 for new MFA device registrations and token reuse from unexpected hosts
CVEs associated with China-nexus WARP PANDA exploits VMware ESXi
Timeline of China-nexus WARP PANDA exploits VMware ESXi
- WARP PANDA activity observed since at least 2022 against IT, legal and manufacturing sectors (CrowdStrike; year only, day approximate)
- CrowdStrike publishes 'Unveiling WARP PANDA', documenting BRICKSTORM, Junction and GuestConduit against vCenter/ESXi
- Start of the period covered by CrowdStrike's 2026 Legal Threat Landscape Report (through 2026-08-31)
- OVERCAST PANDA targets U.K. legal-firm executives during Sept-Oct 2025 (month approximate)
- TITAN PANDA exploits hardcoded IIS machine key in Intapp Time Server (April 2026, day approximate)
- Broadcom publishes VMSA-2026-0006 covering CVE-2026-41709 (CVSS 2.7), reported by Ian Barton of CrowdStrike
- VMSA-2026-0006 last updated with additional fixed builds
- CVE-2026-41709 added to CISA KEV; remediation deadline 2026-11-11
- GBHackers reports China-nexus exploitation of the ESXi flaw against law firms, citing CrowdStrike
Sources cited for China-nexus WARP PANDA exploits VMware ESXi
- Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
- Broadcom VMSA-2026-0006 Security Advisory
- Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary (CrowdStrike)
- CVE-2026-41709 detail (KEV status, affected builds)
- WARP PANDA deployed BRICKSTORM backdoor via VMware vCenter and ESXi (IMDA advisory)
- China-Linked Warp Panda Targets North American Firms in Espionage Campaign
- SC Media: China-linked threat actor WARP PANDA targets US entities with BRICKSTORM
- Malpedia: ELF BRICKSTORM
Detection coverage for TL-2026-4740
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4740 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.