WARP PANDA Weaponizes VMware ESXi Zero-Day Logging Gap to Evade Audit Visibility

State-sponsored cyber espionage group Warp Panda (also tracked as UNC5221, Clay Typhoon, Armory Castle, and VerdantBamboo) weaponized an insufficient logging vulnerability in Broadcom VMware ESX, designated CVE-2026-41709, as a zero-day in campaigns targeting the United States legal sector. The flaw enables authenticated administrative operators to carry out system-level commands and hypervisor modifications without producing standard audit log entries. This gap in forensic telemetry allowed the group to sustain stealthy access across virtualized corporate environments while disabling traditional detection mechanisms.

Following initial intrusion via perimeter edge gateways, the attackers pivoted into internal VMware vCenter platforms to deploy custom implants, including the BRICKSTORM and SharpStorm backdoors. The intrusion extended into hybrid cloud services, where the group harvested cloud session tokens and enrolled unauthorized multi-factor authentication (MFA) devices to maintain persistent access into Microsoft 365 environments even after domain password rotations. In response to confirmed active exploitation, CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026.

Background

Broadcom remediated CVE-2026-41709 on July 29, 2026, within advisory VMSA-2026-0006 following discovery and coordinated reporting by CrowdStrike. In late October 2026, public disclosure revealed that Warp Panda had weaponized this logging omission bug as an active zero-day as late as early 2026 to silence audit trails during intrusions against legal firms handling high-stakes corporate acquisitions, sensitive litigation documents, and privileged client correspondence. CISA assigned a binding operational remediation deadline of November 11, 2026, for all Federal Civilian Executive Branch agencies.

First publicly profiled in December 2025 following intrusions into virtualization clusters, Warp Panda operates alongside adversaries such as Titan Panda and Murky Panda as part of an aggressive China-nexus offensive targeting corporate legal infrastructure. Industry telemetry indicates state-sponsored intrusions against legal firms nearly doubled over baseline figures, as adversaries increasingly view law practices as high-yield collection hubs to intercept proprietary transaction filings, corporate disclosures, and litigation strategy across multiple global enterprises at once. To support these operations, Warp Panda relies on a specialized utility arsenal; historically deploying purpose-built tools such as TetanusStorm, DualGauge, and GuestConduit to navigate complex enterprise infrastructure undetected.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Products
CVE-2026-41709	2.7 (Low)	0.76%	VMware Cloud Foundation 9.1.x.x, 9.0.x.x, 5.x (prior to 5.2.4);  VMware vSphere Foundation 9.1.x.x, 9.0.x.x;  VMware ESXi 9.1.x.x (prior to ESXi-9.1.0.0-25370933), 9.0.x.x (prior to ESXi-9.0.2.0100-25595025), 8.0 (prior to ESXi80U3j-25429389);  VMware Telco Cloud Platform 5.1.x, 5.0.x.

Attack Methodology

1. 1. Perimeter Device Ingress: The threat actor exploits internet-facing edge appliances and network boundary gateways to establish an initial unauthenticated beachhead inside the victim enterprise.
2. 2. Internal Pivoting to Management Planes: Moving laterally across unsegmented internal networks, operators traverse from initial access footholds directly toward centralized VMware vCenter infrastructure.
3. 3. Zero-Day Audit Blindspot Exploitation: Operating with elevated privileges, the actors invoke CVE-2026-41709 on ESX hypervisors, executing administrative changes and host tasks without generating corresponding system audit logs.
4. 4. Hypervisor Implant Deployment: With host command auditing suppressed, the group installs custom backdoors, specifically the BRICKSTORM implant and SharpStorm utility, establishing resilient persistence at the virtualization tier.
5. 5. Cloud Token Extraction and MFA Hijacking: The actors extract valid cloud session tokens to access corporate Microsoft 365 tenants without triggering anomalous authentication prompts, subsequently registering rogue MFA authenticators to persist beyond password resets.
6. 6. Strategic Legal Intelligence Exfiltration: Target data collection centers on sensitive corporate merger strategies, internal litigation materials, and confidential client deliberations.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1562.002	Disable Windows Event Logging / Inhibit System Logging	Defense Evasion
T1078	Valid Accounts	Defense Evasion
T1021	Remote Services	Lateral Movement
T1556.006	Modify Authentication Process: Multi-Factor Authentication	Persistence

Visual Attack Flow

Mitigation

1. 1. Apply Broadcom Security Updates: Upgrade ESXi hypervisors to fixed builds ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, or ESXi-9.1.0.0-25370933; update VMware Cloud Foundation to version 5.2.4 or follow KB449886. Broadcom has published no workarounds.
2. 2. Implement Workload Microsegmentation: Enforce strict network separation isolating ESXi and vCenter management interfaces from standard internal subnets and edge devices, terminating unauthenticated east-west traversal paths.
3. 3. Conduct Entra ID MFA and Session Audits: Inspect cloud directory audit logs for newly registered authenticators and anomalous FIDO2 or TOTP additions; revoke active session tokens across administrative user identities.
4. 4. Enforce Independent Network Telemetry: Deploy out-of-band network traffic observability to baseline egress connections from virtualization hosts, detecting C2 traffic from BRICKSTORM or SharpStorm independent of hypervisor-level logging.