Xitoy davlatiga aloqador xakerlar AQSh advokatlik firmalariga qarshi josuslik operatsiyalarida VMware ESXi'dagi nol kunlik zaiflikdan foydalanishdi, deb xabar qiladi CrowdStrike'ning huquqiy sektorni ta'sir qiladigan tahdidlar bo'yicha so'nggi baholashi.
Faoliyat WARP PANDA'ga, Xitoy bilan bog'liq dushmanga tegishli bo'lib, u jabrlanuvchilarning VMware vCenter muhitlarida zararli dastur joylashtirgan. 2026-yil boshigacha davom etgan bu kirishlar CVE-2026-41709 zaifligidan foydalangan. Bu zaiflik hujumchilarga ESXi'da buyruqlar jurnalini chetlab o'tishga imkon beradi.
CrowdStrike'ning 2026-yilgi Huquqiy Tahdid Manzarasi Hisoboti 2025-yil 1-sentabrdan 2026-yil 31-avgustgacha kuzatilgan faoliyatni o'rganadi. Huquqiy tashkilotlarga qaratilgan kirishlar 2023-yilgi asosiy ko'rsatkichdan deyarli ikki baravar oshdi, bu esa mijozlarning maxfiy ma'lumotlarini saqlaydigan tashkilotlar orasida o'sib borayotgan zaiflikni ko'rsatadi.
WARP PANDA operatsiyalari korporativ muhitlarni qo'llab-quvvatlaydigan virtualizatsiya infratuzilmasiga doimiy qiziqishni namoyon etadi. Xabar qilingan ESXi zaifligi buyruqlar jurnalini chetlab o'tish bilan bog'liq; taqdim etilgan natijalar bu kamchilik mustaqil ravishda dastlabki kirish yoki masofaviy kod bajarilishini ta'minlaganini isbotlamaydi.
Bu farq muhim, chunki buyruqlar jurnalini chetlab o'tish infratuzilma allaqachon buzilgandan keyin hujumchilarning harakatlari haqida himoyachilarning ko'rinishini kamaytirishi mumkin.
WARP PANDA'ning VMware vCenter kirishlari haqidagi avvalgi xabarlar BRICKSTORM orqa eshiklari, JSP veb qobiqlari va ESXi xostlari hamda mehmon virtual mashinalariga qaratilgan maxsus implantlarni hujjatlashtirgan. Bu operatsiyalar doimiy kirishni yashirin texnikalar bilan birlashtirgan, jumladan jurnallarni tozalash, fayllarni vaqt belgilarini o'zgartirish va zararli virtual mashinalarni vCenter'da ro'yxatdan o'tkazmasdan qoldirish.
So'nggi natijalar ta'sirlangan ESXi versiyalari, CVSS bahosi yoki CVE-2026-41709 uchun tuzatish tafsilotlarini taqdim etmaydi. CrowdStrike huquqiy tashkilotlarga qarshi bir nechta qo'shimcha Xitoy bilan bog'liq operatsiyalarni aniqladi.
2026-yil aprelida TITAN PANDA Intapp Time Server'dagi qattiq kodlangan IIS mashina kaliti zaifligidan foydalandi — bu asosan advokatlik firmalari tomonidan ishlatiladigan vaqtni hisoblash va hisob-kitob ilovasi.
MURKY PANDA'ning ORB28 parol purkash kampaniyasi bir nechta sektorlardagi 340 dan ortiq tashkilotga ta'sir qildi, huquqiy tashkilotlar eng ko'p ta'sirlanganlar orasida. Bir firma 30 kun davomida taxminan 300 IP manzildan kelgan, taxminan shuncha hisob qaydnomalariga qarshi deyarli 500 ta muvaffaqiyatsiz kirish urinishini qayd etdi.
OVERCAST PANDA alohida ravishda 2025-yil sentabr va oktyabr oylarida Buyuk Britaniyadagi huquqiy firmaning rahbar darajasidagi xodimlarini nishonga oldi.
Bu operatsiyalar kengroq Xitoy bilan bog'liq bulut kirish faoliyatini to'ldiradi va buzilgan infratuzilma bilan bir qatorda identifikatsiya tizimlarini tekshirish zarurligini ta'kidlaydi.
Josuslik kuchayganiga qaramay, moliyaviy motivatsiyaga ega ishtirokchilar huquqiy tashkilotlarga qarshi kuzatilgan faoliyatning 82% ni tashkil etdi. Tovlamachilik guruhlari oqish saytlarida 455 ta huquqiy tashkilotni nomladi, bu yildan-yilga 39% ga oshdi.
Birlashtirilgan tahdid virtualizatsiya platformalari, bulut identifikatorlari, maxsus ilovalar va mijoz ma'lumotlariga imtiyozli kirish huquqiga ega xodimlarni qamrab oladi.
Huquqiy sektor himoyachilari uchun markaziy muammo shuning uchun yagona zaiflikdan kengroq: infratuzilma va identifikatsiya chegaralarini kesib o'tadigan kirishlarni aniqlash va jinoyatchilar hamda razvedka yig'uvchilar uchun qimmatli maxfiy materialni himoya qilish.
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector.
The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into early 2026, exploited CVE-2026-41709. This vulnerability allows attackers to bypass command logging in ESXi.
CrowdStrike’s 2026 Legal Threat Landscape Report examines activity observed between September 1, 2025, and August 31, 2026. Intrusions targeting legal entities nearly doubled from the 2023 baseline, highlighting growing exposure across organizations holding sensitive client information.
WARP PANDA’s operations show sustained interest in virtualization infrastructure that supports corporate environments. The reported ESXi vulnerability concerns command logging bypass; the supplied findings do not establish that this flaw independently provided initial access or remote code execution.
That distinction matters because bypassing command logging can reduce defenders’ visibility into attacker actions after infrastructure has already been compromised.
Earlier reporting on WARP PANDA’s VMware vCenter intrusions documented BRICKSTORM backdoors, JSP web shells, and specialized implants targeting ESXi hosts and guest virtual machines. Those operations combined persistent access with stealth techniques, including clearing logs, timestomping files, and leaving malicious virtual machines unregistered in vCenter.
The latest findings do not provide affected ESXi versions, a CVSS score, or remediation details for CVE-2026-41709. CrowdStrike identified several additional China-nexus operations against legal organizations.
In April 2026, TITAN PANDA exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, a timekeeping and billing application used predominantly by law firms.
MURKY PANDA’s ORB28 password-spraying campaign affected more than 340 organizations across multiple sectors, with legal entities the most affected. One firm recorded nearly 500 failed login attempts against approximately as many accounts, originating from roughly 300 IP addresses over 30 days.
OVERCAST PANDA separately targeted executive-level personnel at a U.K. legal firm during September and October 2025.
These operations complement broader China-linked cloud intrusion activity, underscoring the need to investigate identity systems alongside compromised infrastructure.
Despite intensifying espionage, financially motivated actors accounted for 82% of observed activity against legal entities. Extortion groups named 455 legal organizations on leak sites, up 39% year over year.
The combined threat spans virtualization platforms, cloud identities, specialized applications, and employees with privileged access to client information.
For legal-sector defenders, the central challenge is therefore broader than a single vulnerability: identifying intrusions that cross infrastructure and identity boundaries while protecting confidential material valuable to both criminals and intelligence collectors.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
