China-Linked Group Used VMware Flaw to Hide Its Tracks in Attacks on US Law Firms

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in Broadcom VMware ESX to its Known Exploited Vulnerabilities catalog. The flaw, CVE-2026-41709, is an insufficient logging issue that could let an attacker with admin access carry out certain actions without them being recorded. It has a low severity score of 2.7, but CrowdStrike says the China-nexus group Warp Panda exploited it as a zero-day in early 2026 to reduce audit trail visibility in attacks on the US legal sector. Broadcom addressed the issue in an advisory in July 2026.

According to CrowdStrike's 2026 Legal Threat Landscape Report, Warp Panda targets internet-facing edge devices using zero-day vulnerabilities and custom malware to keep covert, persistent access. After gaining entry, the group moves into VMware vCenter environments and deploys custom malware called BRICKSTORM and SharpStorm. The group is also tracked as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo, and has a history of exploiting zero-days in Citrix NetScaler and Ivanti Connect Secure. Mandiant has also linked it to the exploitation of a critical BeyondTrust Remote Support flaw.

Some intrusions also targeted cloud services to steal user session tokens, allowing access to Microsoft 365 without triggering credential-based alerts. In at least one case, the group registered a new multi-factor authentication (MFA) device on a compromised account, keeping access even if the password was changed. This article covers only the opening of the source report.