Threat actor
Warp Panda
China
Tracked by CyberSIXT since 11 Dec 2025
- Articles · all time
- 3
- Articles · last 30 days
- 2
- CVEs exploited · attributed
- 1
- Research reports · all time
- 0
Names and sources
- WARP PANDA
- Named by CyberSIXT coverage
- WARP PANDA
- Named by Malpedia · warp_panda
- WARP PANDA
- Named by MISP Galaxy · 820afecb-e91f-424e-8e70-0ac880963191
- Warp Panda
- Named by CyberSIXT coverage
- 820afecb-e91f-424e-8e70-0ac880963191
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · 820afecb-e91f-424e-8e70-0ac880963191)
CVEs exploited
1 CVE an article attributes to Warp PandaCVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability · attributed by Mandiant and Google Threat Intelligence Group (GTIG), Mandiant, 16 Oct · Source articleCVSS9.3CriticalExploited1.2%EPSS0articles
Vendors targeted
- Chinese APT exploited BeyondTrust Remote Support flaw to steal filesSecurityWeek
- China Linked Hackers Exploited BeyondTrust Zero Day to Steal CredentialsThe Hacker News
- China’s WARP PANDA APT Deploys BRICKSTORM Backdoor to Hijack VMware vCenter/ESXi and Azure CloudSecurityOnline · first in our coverage