China-Linked Warp Panda Targets North American Firms in Espionage Campaign

CrowdStrike identified Warp Panda, a sophisticated PRC-aligned cyber-espionage actor active since at least 2022, conducting long-term persistent intrusions against North American legal, technology and manufacturing firms by compromising internet-facing edge devices and VMware vCenter environments. The actor deployed BRICKSTORM (a Golang backdoor) and two novel Golang implants (Junction and GuestConduit), leveraged valid credentials and vCenter vulnerabilities, used SSH/SFTP and log-tampering for lateral movement and data exfiltration, and tunneled traffic through vCenter/ESXi/guest VMs; CISA published a joint advisory confirming BRICKSTORM-based persistence on vSphere platforms.