China-Linked WARP PANDA Exploits VMware ESX Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike disclosed on 28 October 2026 that the China-linked threat group WARP PANDA exploited a previously unknown vulnerability in VMware ESX to perform operations without generating log entries on compromised hypervisors.
The flaw, tracked as CVE-2026-41709, received a CVSS 3.1 base score of only 2.7 yet was added the same day to the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline set for 11 November. Broadcom’s advisory characterizes the issue as insufficient logging: a malicious administrator can execute specific operations that simply do not appear in the audit trail.
The vulnerability requires high privileges and affects only integrity; it does not provide remote code execution or administrative access by itself. Its utility for attackers lies in what it conceals—once an adversary already possesses administrator rights on the hypervisor, they can act without leaving the forensic artifacts that response teams use to reconstruct incidents.
Broadcom does not enumerate the exact operations that bypass logging and states that the flaw does not retroactively delete existing logs. The exploitation was detailed in CrowdStrike’s threat report covering legal-sector targets and spanning 1 September 2025 to 31 August 2026, with activity accelerating in early 2026.
Recommended hunting indicators include the presence of BRICKSTORM and SharpStorm malware in vCenter environments, unauthorized cloud session tokens, and second-factor authentication records created without authorization. The researcher credited by Broadcom for the report is Ian Barton.
Patches are delivered via specific builds rather than simple version numbers. The corrected ESXi builds are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389. For VMware Cloud Foundation on the 5.x line, administrators must apply version 5.2.4. No alternative mitigations have been published.
The case underscores why organizations should not rely solely on CVSS scores when prioritizing patches; a low-severity logging bypass became the weapon of choice for a nation-state espionage actor before a fix existed.
Related articles
North Korean WaterPlum Group Infects 30,000 Computers Across 100 Countries via Fake Coding Tests
The North Korean-linked group WaterPlum, also known as Contagious Interview, has infected at least 30,000 computers in more than 100 countries between December 2025 and July 2026. According to the Internet Crime Complaint Center (IC3), the operation moved at least $10.7 million in cryptocurrency to North Korea and compromised more than 7,000 wallets. Attackers pose as recruiters on social media and freelance platforms, luring software developers with nonexistent job offers that require downloading malicious files disguised as coding tests. The malware arsenal includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, with the latter hiding inside blockchain-themed projects and abusing Visual Studio Code configurations. Developers are specifically targeted because they often store production keys, wallets, and credentials on the same machines used for testing third-party code. Japanese authorities have dismantled laptop farms connected to the scheme that helped maintain the attackers' operational cover.
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.
APT28 Expands Espionage with New HOOKEDGE Backdoor Targeting European Organizations
The Russian-linked APT28 group, also known as BlueDelta, has deployed a new lightweight backdoor called HOOKEDGE as part of a cyber-espionage campaign against strategic European entities. The attacks, assessed with moderate confidence, targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Turkey between September 2025 and April 2026. Infection begins with spear-phishing emails delivering Microsoft Word documents containing malicious macros that mimic official Spanish government materials. Upon execution, the macros drop files, establish persistence via scheduled tasks, and deploy the HOOKEDGE backdoor written in batch scripts. The malware uses hidden Microsoft Edge instances and the legitimate webhook.site service to blend command-and-control traffic with normal web activity. In high-value victims, operators installed a second HOOKEDGE instance with five-minute check-ins for faster control and data collection. The backdoor shows strong code similarities to the older HEADLACE implant previously attributed to the same group.
Iran-Linked Cyber Attack Leaves Small UK Power Plant Offline for Four Days
A cyber attack attributed to hackers with suspected ties to Iran took a small-scale UK power generation facility offline for approximately four days in July 2026. The incident affected a roughly 15 MW generator used to support peak demand periods, yet caused no customer outages or disruption to the national electricity grid. British authorities have not issued an official attribution, and investigators have not publicly identified the malware, vulnerability, or initial access vector used in the operation. Recovery required four days of extensive validation across controllers, configurations, security systems, and remote access points to ensure no residual risks remained. The case highlights the operational challenges of restoring industrial control environments after suspected nation-state activity. In response, UK authorities have strengthened guidance for the energy sector and are considering additional protective measures for critical infrastructure suppliers.