ThreatRoundup

WARP PANDA (CrowdStrike designation)

China-nexus group that breaks in through edge devices, plants BRICKSTORM and ESXi implants in VMware, steals Microsoft 365 sessions and used an ESX zero-day to dodge logs.

Threat actor profile · Updated

Active
2022 to early 2026
Origin
China (China-nexus, per CrowdStrike)
Type
State-sponsored
Affiliates
BRICKSTORM users including UNC5221 / ARMORY CASTLE (GTIG); The Hacker News equates WARP PANDA with ARMORY CASTLE, Clay Typhoon and VerdantBamboo (unconfirmed by CrowdStrike)
Regions targeted
United States, North America, Asia Pacific

What each vendor calls it

CrowdStrike
WARP PANDA

See this actor in the Threat Actor Rosetta Stone →

Profile

WARP PANDA is CrowdStrike’s name for a China-nexus espionage adversary that it first described publicly in December 2025. CrowdStrike says the group has been active since at least 2022, calls it “cloud-conscious”, and says it is the only adversary it has seen using the BRICKSTORM backdoor together with two ESXi implants it named Junction and GuestConduit. Its intrusions have hit US legal, technology and manufacturing organizations, with the bulk of activity in North America. In one case CrowdStrike says the group went after the mailboxes of employees working on topics aligned with Chinese government interests, and it likely used its access for basic reconnaissance against an Asia Pacific government body.

The playbook runs from the edge to the hypervisor. CrowdStrike says WARP PANDA gets in through internet-facing edge devices (it lists Ivanti Connect Secure and F5 BIG-IP flaws) and then pivots to VMware vCenter with valid credentials or vCenter exploits. On vCenter it plants BRICKSTORM, a Go backdoor disguised as vCenter processes that tunnels traffic and survives reboots, plus JSP web shells. On ESXi hosts it installs Junction, which listens on port 8090 and talks to guest virtual machines over VSOCK, and inside those guests GuestConduit, a tunneler on VSOCK port 5555. That pairing lets the operators move traffic between the hypervisor and the machines it hosts without touching the normal network. One intrusion began in late 2023 and the access was long-term.

The cloud side is what earns the “cloud-conscious” label. In late summer 2025, CrowdStrike says, the group used its foothold to reach several victims’ Microsoft Azure tenants, replayed session tokens it had likely taken from browser files through BRICKSTORM tunnels (T1550.004 (Use Alternate Authentication Material: Web Session Cookie)), and pulled SharePoint files belonging to network engineering and incident response teams. In one case it registered a new MFA device on a compromised account (T1098.005 (Account Manipulation: Device Registration)), and it used Microsoft Graph to enumerate apps, service principals, users, roles and email.

The most recent reporting is about hiding. CrowdStrike’s 2026 Legal Threat Landscape Report says WARP PANDA exploited CVE-2026-41709, an ESX flaw that lets an administrator perform some operations without them being logged, as a zero-day in several cases, as late as early 2026. The bug scores only 2.7 because it grants nothing new; its value is that it removes the audit trail defenders would use to find the group. CISA added it to the Known Exploited Vulnerabilities catalog on October 28, 2026.

How WARP PANDA maps to other vendors’ names is not settled in primary sources. CrowdStrike names no other vendor’s cluster and notes industry reporting that BRICKSTORM may be used by several adjacent China-nexus actors. Google Threat Intelligence Group ties BRICKSTORM to UNC5221, which it now calls ARMORY CASTLE (see the UTA0178 profile), and CISA, the NSA and Canada’s Cyber Centre attribute BRICKSTORM to PRC state-sponsored actors. The Hacker News states that WARP PANDA is also tracked as ARMORY CASTLE (formerly UNC5221), Clay Typhoon and VerdantBamboo, without citing a source; treat that as a reported overlap, not a confirmed one.

Events

Date Target Narrative Source Our coverage
Early 2026 US entities, including legal-sector organizations Zero-day use of CVE-2026-41709 in VMware ESX in several intrusions to carry out admin operations without audit log entries, alongside malware deployed in vCenter environments. CrowdStrike Our story
2025 (late summer) Several organizations’ Microsoft Azure and Microsoft 365 tenants Session tokens replayed through BRICKSTORM tunnels to reach OneDrive, SharePoint and Exchange; SharePoint files on network engineering and incident response downloaded; a rogue MFA device registered; Microsoft Graph used for enumeration. CrowdStrike
2025 (summer) US legal, technology and manufacturing organizations Multiple intrusions into VMware vCenter environments via edge devices (T1190 (Exploit Public-Facing Application)), with BRICKSTORM, JSP web shells and the ESXi implants Junction and GuestConduit. CrowdStrike
Not disclosed Asia Pacific government entity CrowdStrike says the group likely used existing access for rudimentary reconnaissance against the entity. CrowdStrike
2023 (late) Not disclosed Initial access in one of the intrusions CrowdStrike later investigated; the group kept long-term persistence. CrowdStrike
2022 Not disclosed Earliest activity CrowdStrike attributes to WARP PANDA. CrowdStrike

Target vectors risk profile

Edge devices/VPNs Virtualization (vCenter/ESXi) Legal/professional services Technology/SaaS Cloud/identity Manufacturing Government Finance Ransomware/extortion
High High High High High Medium Low N/A N/A

Malware and tools

Name What it does Public detection Hunt Leads Reports
BRICKSTORM Go backdoor disguised as vCenter processes; tunneling and file management over WebSockets, DNS-over-HTTPS and public cloud services Hunting query and hashes in CrowdStrike’s report; YARA and Sigma rules in CISA AR25-338A; Mandiant’s brickstorm-scanner CrowdStrike, CISA
Junction Go implant on ESXi hosts posing as a VMware service on port 8090; runs commands, proxies traffic and talks to guest VMs over VSOCK Hashes and hunting query in CrowdStrike’s report CrowdStrike
GuestConduit Go tunneler inside guest VMs listening on VSOCK port 5555, likely paired with Junction Hash and hunting query in CrowdStrike’s report CrowdStrike
JSP web shells Web shells on vCenter servers for command execution None published CrowdStrike
7-Zip (ESXi build) Legitimate archiver used to stage data and pull VM disk contents None published CrowdStrike

Reports

Date Source Report
2026-10-29 The Hacker News China-linked hackers exploited VMware ESX zero-day to reduce audit trail visibility
2026-10-28 CrowdStrike CrowdStrike 2026 Legal Threat Landscape Report: eCrime leads attacks, China activity intensifies
2026-07 Broadcom VMware security advisory covering CVE-2026-41709
2025-12-04 CrowdStrike Unveiling WARP PANDA: a new sophisticated China-nexus adversary
2025-12-04 CISA, NSA, Canadian Centre for Cyber Security BRICKSTORM backdoor (AR25-338A)
2025-09-24 GTIG / Mandiant Another BRICKSTORM: stealthy backdoor enabling espionage into tech and legal sectors

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2026-41709 2.7 Low Broadcom (VMware) ESX Yes
CVE-2024-38812 9.8 Critical Broadcom (VMware) vCenter Server Yes
CVE-2024-21887 9.1 Critical Ivanti Connect Secure and Policy Secure Yes
CVE-2023-46805 8.2 High Ivanti Connect Secure and Policy Secure Yes
CVE-2023-46747 9.8 Critical F5 BIG-IP Yes
CVE-2023-34048 9.8 Critical VMware vCenter Server Yes
CVE-2021-22005 9.8 Critical VMware vCenter Server Yes

If you’re in their sights

Do this now

  1. Patch edge devices and vCenter fast, starting with the Ivanti, F5 and vCenter flaws above, and update ESX to Broadcom’s fixed builds for CVE-2026-41709.
  2. Ship ESXi and vCenter logs to a system the hosts can’t alter, and don’t read a quiet log as a clean bill of health: this group exploits a bug designed to leave no entries.
  3. Cut vCenter and ESXi off from the internet in both directions, disable SSH on ESXi where you can, enable execInstalledOnly, and alert on anything listening on port 8090 or unexpected VSOCK traffic.
  4. Look for virtual machines that aren’t in your inventory and for root or vpxuser SSH logins you can’t explain.
  5. In Microsoft 365, alert on new MFA device registrations and on sessions reused from unfamiliar infrastructure, and require MFA through your identity provider for vCenter access.

Compiled from CrowdStrike, CISA, the NSA and the Canadian Centre for Cyber Security, Google Threat Intelligence Group, Broadcom and The Hacker News, plus ThreatRoundup reporting. Last reviewed November 1, 2026.

ThreatRoundup coverage

2 of these stories have Hunt Leads: detection-ready leads for threat hunters.

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.