Chinese Malware Targeting US Organizations: Warp Panda's Attack Campaign

Securityweek

Chinese Malware Targeting US Organizations: Warp Panda's Attack Campaign

First seen 5 Dec 2025, 22:42 UTC • •26.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The China-linked threat actor Warp Panda has been targeting US organizations in the legal, manufacturing, and technology sectors using advanced malware. The malware variants identified include BrickStorm, Junction, and GuestConduit, which are employed for long-term persistence in these attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 224d ago How this analysis works

More articles in this cluster (2)

Threat Graph

6 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Long Warp Panda
Warp Panda

Technique (1)

Malware

Malware (3)

Brickstorm
GuestConduit
Junction

Relationships

Long Warp Panda uses Brickstorm
Long Warp Panda uses GuestConduit
Long Warp Panda uses Junction
Warp Panda uses Brickstorm
Warp Panda uses GuestConduit
Warp Panda uses Junction
Long Warp Panda uses Malware
Warp Panda uses Malware

Following this threat?

Track Long Warp Panda and Brickstorm in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Storm-0940 Uses AI to Compromise 2,250 Microsoft 365 Tenants via ConnectWise Backup On October 21, 2026, Microsoft disclosed that the China-aligned hacker group Storm-0940 exploited the ConnectWise Cloud Backup application to gain unauthorized access to over 2,250 Microsoft 365 tenants. The attackers utilized ARTEX, an open-source AI penetration testing framework, to automate their attacks, achieving…