WARP PANDA

Warp Panda is a China-aligned cyber espionage threat actor focused on stealthy, long-term compromise of enterprise virtualization and cloud-connected infrastructure. The group has been linked to intrusions against U.S.-based organizations since at least late 2023, with reporting also tying BRICKSTORM-related activity associated with the actor back to at least 2022. Warp Panda is also tracked as Clay Typhoon and Storm-2416. The actor is notable for targeting VMware vCenter and ESXi environments and for abusing edge-device compromises as a pathway into core virtualization management layers. Observed operations commonly begin with exploitation of internet-facing edge infrastructure, followed by pivoting into vCenter using valid credentials or exploitation of vCenter vulnerabilities. Warp Panda has also been reported among China-nexus actors exploiting CVE-2023-34048. The group has demonstrated abuse of built-in and privileged VMware accounts, including the vpxuser account, to maintain persistence, obtain privileged access, and move laterally. Warp Panda’s malware and tooling emphasize covert persistence and traffic concealment. The actor has deployed JSP web shells and the Golang backdoor BRICKSTORM on VMware vCenter systems, and has also used previously unobserved Golang implants known as Junction and GuestConduit on ESXi hosts and guest virtual machines. BRICKSTORM supports tunneling, file management, and durable persistence, while Junction and GuestConduit extend control and traffic proxying across ESXi and guest VM boundaries. Reporting also associates Warp Panda with targeting Azure cloud environments and Microsoft 365 resources, including access to email and cloud-hosted collaboration data. Tradecraft attributed to Warp Panda includes persistence, lateral movement, privileged account abuse, covert tunneling through virtualization infrastructure, data staging for exfiltration, log clearing, timestomping, and creation of unregistered malicious virtual machines to evade inventory-based detection. The actor has used SSH and SFTP for internal movement and file transfer, staged data from virtual machine snapshots, and cloned domain controller virtual machines to obtain sensitive Active Directory data. In at least one intrusion, the actor accessed employee email accounts related to topics aligned with Chinese government interests. The overall pattern is consistent with intelligence collection rather than financially motivated activity. Victimology reported for Warp Panda includes U.S. legal, technology, and manufacturing organizations, with additional indications of interest in government-related targets and Asia-Pacific government entities. The actor is assessed as highly sophisticated, well-resourced, and aligned with the strategic intelligence priorities of the People’s Republic of China.