Hackers Linked to China Hid Their Tracks in Law Firm Attacks

A hacking group tied to China used a flaw in VMware software to avoid leaving records of what it did inside U.S. law firms. On Wednesday, the U.S. cybersecurity agency CISA added the flaw to its list of bugs that criminals are actively using. Security firm CrowdStrike says the group, called Warp Panda, used it as a zero-day, meaning before a fix existed, in early 2026.

What changed

The flaw is tracked as CVE-2026-41709 and affects Broadcom VMware ESX, software that runs virtual computers on company servers. It is a logging problem. Someone with admin access could carry out certain actions without those actions being written to the audit log, the record IT teams use to spot trouble. Broadcom said it fixed the issue in an advisory in July 2026.

The flaw is only one piece. CrowdStrike says Warp Panda breaks in through devices that face the internet, then moves to VMware vCenter, the tool used to manage those virtual machines. There it installs custom malware named BRICKSTORM and SharpStorm to stay hidden. The group has a history of using zero-days in Citrix NetScaler and Ivanti Connect Secure. Mandiant also linked it this month to a serious BeyondTrust Remote Support flaw, CVE-2026-102764.

Why it matters

Some intrusions also reached Microsoft 365. The group took session tokens, which are digital passes that keep a user signed in, so no password alert went off. In at least one case, it added its own multi-factor sign-in device to a hacked account. That gives it a way back in even after the password is changed.

CrowdStrike says law firms are a rich target because they hold client messages, merger documents and litigation plans, and often have access across many clients.

Who can relax

The flaw has a low severity score of 2.7. The reason is that an attacker needs admin access first, so it cannot be the way in. Anyone who does not run VMware ESX or vCenter is not affected by this particular bug. The wider tactics, though, apply to any business that uses Microsoft 365 or the other named devices.

What to do

The alert box above lists the steps. The main ones are to install the July update, patch internet-facing devices and look for sign-in devices nobody recognizes. If you rely on an IT provider, send them this story and ask for confirmation.

What happens next

U.S. federal civilian agencies must apply the fix by November 11, 2026. The material does not say how many law firms were hit, which ones, or what was taken. Private companies face no such deadline, but the same date is a sensible target.