Warp Panda Used VMware Zero-Day to Hide Attacks on U.S. Law Firms

A logging deficiency in VMware ESX allowed attackers with administrative privileges to conduct operations without triggering audit records. China-backed group Warp Panda deployed this vulnerability as a zero-day against U.S. law firms starting in early 2026. Although the flaw carries a low CVSS score of 2.7, its impact on visibility made it valuable for maintaining undetected persistence. Broadcom released patches in July, and CISA later added it to its catalog of actively exploited vulnerabilities.

Warp Panda’s intrusion chain typically begins with compromised edge devices—particularly internet-facing appliances—before moving laterally into VMware vCenter infrastructure. The group deploys custom malware payloads like BRICKSTORM to establish covert footholds. Beyond hiding malicious activity, the attackers harvest session tokens from cloud environments to access Microsoft 365 accounts and configure backdoor MFA devices, ensuring access persists even after credential changes.

The targeting of law firms reflects their value as intelligence targets: they control sensitive client communications, M&A materials, litigation plans, and cross-client relationships that appeal to state-backed adversaries. This campaign fits a broader pattern—Warp Panda, tracked under multiple aliases including Armory Castle and VerdantBamboo, has systematically exploited zero-days in edge security products like Citrix and Ivanti appliances. Federal agencies face a November 11 deadline to patch the vulnerability.