Chinese-linked hacking group Warp Panda returned with more virtualization-related vulnerability exploits.

CrowdStrike research claimed the group exploited CVE-2026-41709, an insufficient logging vulnerability in VMware ESX first discovered in July. The flaw allowed attackers to bypass administrative command logging and conceal malicious activity, while malware was deployed within VMware vCenter environments.

The breaches occurred before Broadcom patched the flaws in question, which affected vCenter and associated Cloud Foundation, vSphere Foundation, and Telco Cloud services.

In response, the Cybersecurity and Infrastructure Security Agency (CISA) this week added the flaw to its Known Exploited Vulnerabilities catalogue with a low severity rating. Affected U.S. federal agencies are required to remediate the issue by November 11.

CrowdStrike’s revelations came in a report on threats to the legal sector, but noted the campaign also affected technology and manufacturing sectors. Warp Panda operatives typically exploit vulnerabilities in internet-facing edge devices, including Ivanti Connect Secure VPN appliances and F5 BIG-IP systems, to gain initial access before moving laterally into VMware vCenter environments. Once there, they deployed custom malware including Brickstorm, a backdoor tool that mimics legitimate vCenter processes.

Some attacks targeted Microsoft cloud environments, with Brickstorm used to access Microsoft 365 services. The attackers downloaded sensitive SharePoint documents, including files concerning network engineering and incident response teams.

"CrowdStrike Intelligence assesses with moderate confidence that Warp Panda will continue to prioritize virtualization infrastructure and edge device vulnerabilities ... through at least mid 2027," CrowdStrike's researchers warned.