WARP PANDA shows how AI-era intrusions abuse cloud identities

At a glance

What this is: This CrowdStrike analysis shows WARP PANDA combining edge-device exploitation, valid account use, token replay and MFA device registration to maintain covert access in VMware and Microsoft 365 estates.

Why it matters: IAM, PAM and NHI teams need to treat session tokens, privileged service accounts and post-authentication device enrolment as active control points, not just authentication events.

Context

WARP PANDA is a cloud intrusion campaign built around identity misuse, not simple perimeter compromise. The group moves from exposed edge devices into VMware vCenter and Microsoft 365 environments, then uses valid credentials, session tokens and MFA enrolment to stay inside. For identity programmes, the problem is not only initial access but the durability of access after authentication has already succeeded.

The governance gap is that many controls still assume access is issued, reviewed and revoked in stable cycles. WARP PANDA exploits the space between those assumptions by blending into legitimate administration paths, using privileged accounts and session material that look operationally normal until they are chained together for persistence and data access.

Key questions

Q: What fails when attackers can turn a valid login into cloud persistence?

A: The failure is assuming authentication ends the security problem. In these intrusions, valid credentials, session tokens and MFA enrolment let the actor stay inside after the initial login path was disrupted. The practical risk is that identity state becomes the real persistence layer, so review and revocation must watch what happens after sign-in, not only at sign-in.

Q: Why do session cookies and tokens create more risk than passwords once MFA is in place?

A: Session cookies and tokens are valuable because they can let an attacker impersonate a user after authentication has already succeeded, including bypassing MFA. They are harder to detect than stolen passwords and may be long-lived, especially refresh tokens. That combination gives adversaries time for persistence, lateral movement, and privilege escalation before defenders notice the compromise.

Q: How do vCenter or hypervisor compromises widen the blast radius of an intrusion?

A: They expose the management plane, which governs many workloads and can reach directories, snapshots and cloud-connected services. Once an attacker controls that layer, they can move laterally, stage data and manipulate virtual infrastructure with less friction than on a single host. That is why hypervisor and management-plane access must be treated as high-impact privilege.

Q: Should organisations separate management-plane access from day-to-day administrator access?

A: Yes. The article shows why a shared administrative path creates unnecessary reach across VMware, cloud services and directory assets. Separate roles, stricter logging and tighter approval for management-plane actions reduce the chance that one compromised identity can touch virtual machines, SaaS data and identity infrastructure in the same incident.

Technical breakdown

How edge-device compromise becomes identity-led persistence

WARP PANDA shows a common escalation pattern in modern cloud intrusions: public-facing device exploitation creates the foothold, but identity artefacts create the persistence. After initial access through Ivanti or F5 vulnerabilities, the actor pivots into vCenter and cloud services using valid accounts, stolen session material and privileged management paths. In practice, the breach boundary moves from code execution on an appliance to trust abuse inside the identity plane. That matters because once the actor is operating with legitimate credentials or replayable tokens, perimeter controls no longer describe the real attack surface. The real control surface becomes authentication state, token lifetime, device trust and privileged session governance. Practical implication: monitor post-authentication activity as aggressively as initial login events.

Practical implication: monitor post-authentication activity as aggressively as initial login events.

Why session tokens and MFA enrolment extend attacker dwell time

Session tokens let an attacker inherit an already-authenticated state without re-running the full authentication ceremony. In this case, CrowdStrike says WARP PANDA used user session tokens and later registered a new MFA device, which turns a stolen session into a longer-lived trust relationship. That is especially dangerous in SaaS and cloud environments because the actor can keep using the account even after the original password path is addressed. MFA device registration is not just account takeover, it is a change to the assurance boundary itself. If post-login device changes are weakly governed, attackers can convert a one-time intrusion into repeatable access. Practical implication: treat token use and MFA device changes as high-risk identity events, not routine admin noise.

Practical implication: treat token use and MFA device changes as high-risk identity events, not routine admin noise.

How vCenter privilege becomes a cloud control plane

vCenter and ESXi environments are particularly sensitive because they sit above workloads and storage, so compromise there can expose many downstream systems at once. WARP PANDA used privileged vCenter access, SSH and vpxuser activity to move laterally, stage data and clone domain controller VMs. That means the adversary was not merely inside a server, it was inside the management plane that governs multiple systems. This is where cloud identity, workload identity and administrative privilege intersect. When the management plane is abused, the actor can collect data, manipulate virtual infrastructure and hide activity with far less friction than on a single host. Practical implication: separate management-plane privileges from day-to-day administration and alert on any anomalous SSH use of native vCenter accounts.

Practical implication: separate management-plane privileges from day-to-day administration and alert on any anomalous SSH use of native vCenter accounts.

Threat narrative

Attacker objective: The objective was persistent covert access for intelligence collection and data access across virtualised and cloud environments.

1. Entry began with exploitation of internet-facing edge devices and, in some cases, vCenter vulnerabilities, giving the actor a path into the environment.
2. Credential access and abuse followed through valid credentials, user session tokens and privileged vCenter account use, which let the actor operate as an authenticated insider.
3. Escalation and lateral movement occurred through SSH, vpxuser, malicious virtual machines and access to Azure and Microsoft 365 services, expanding the blast radius.
4. Impact included data staging, access to SharePoint and email, cloning of domain controller VMs and covert long-term persistence across virtual infrastructure.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity controls fail when attackers can turn a login into a control-plane foothold: WARP PANDA is not just abusing credentials, it is abusing the assumption that authentication is the meaningful boundary. Once valid credentials, session tokens and privileged management access are in play, the control plane itself becomes the target. The implication is that identity security for cloud and virtual infrastructure must be measured by post-authentication authority, not by login success rates.

Ephemeral access does not help if session trust can be extended midstream: The article shows how a stolen session can be prolonged through MFA device enrolment and reused through cloud services and vCenter. That breaks the idea that session start and session end are the only governance points that matter. Practitioners need to recognise that trust can be re-established inside the session, not only at the beginning.

Privilege concentration in management planes creates identity blast radius: A vCenter administrator path can expose many workloads, backups and directory assets at once. That is why privileged management accounts and hypervisor tooling deserve NHI-grade governance even when they support infrastructure operations rather than application access. The practitioner takeaway is to treat management planes as identity-critical infrastructure, not as ordinary admin convenience.

Cloud identity abuse now spans human accounts, service access and administrative tokens: The campaign moved across Microsoft 365, Azure, vCenter and VMware components using whatever trust material was available. That cross-boundary behaviour shows why separate IAM, PAM and NHI programmes cannot stay siloed when attackers chain them together. The implication is to govern the delegation chain, not just each credential in isolation.

Long-term covert access depends on identity reuse, not only malware stealth: BRICKSTORM and the related implants matter because they preserved access, but the persistence also came from reusable identity paths, legitimate tooling and administrative trust. Stealth tools are only effective when identity governance lets the actor keep returning. Practitioners should therefore map persistence to the access path that sustains it, not only to the malware sample itself.

What this signals

Identity-led intrusion paths now matter more than single-system compromise: WARP PANDA moves across edge devices, virtualisation layers and SaaS using the trust material that already exists in the environment. That means programme owners need to map where credentials, sessions and privileged management accounts can be reused across domains, because the attacker is doing exactly that.

Cloud and virtual infrastructure should be governed as one identity surface: The campaign demonstrates that vCenter, ESXi, Azure and Microsoft 365 are not separate problems when the same actor can chain them together. Practitioners should align IAM, PAM and NHI controls so authentication, session state and administrative privilege are reviewed together rather than in isolation.

Management-plane trust is the new identity blast radius: Once an adversary reaches vCenter or equivalent control points, the rest of the estate inherits that compromise. The operational signal to watch is not just a breached account, but whether one identity can now reach snapshots, email, cloud roles and hypervisor controls from the same trust boundary.

For practitioners

• Harden session-token handling across cloud apps Treat browser-derived session tokens as privileged artefacts. Alert on replay patterns, impossible travel after token reuse and access to Microsoft 365 resources that occurs without a fresh authentication event.
• Flag MFA device registration as a high-risk change Review every new Authenticator enrolment, especially when it follows successful login from a suspicious host, edge appliance or unusual geography. Force step-up review for post-login device changes.
• Restrict direct access to vCenter management accounts Keep native management accounts out of interactive SSH use and isolate them from routine administrator workflows. Any SSH activity using vpxuser or similar platform-managed accounts should be treated as malicious until proven otherwise.
• Instrument the management plane for lateral movement Correlate vCenter, ESXi, Azure and Microsoft 365 audit trails so one actor cannot hide behind separate logs. Look for VM cloning, snapshot access, SharePoint downloads and service principal enumeration in the same incident window.
• Separate workload administration from identity administration Reduce the number of principals that can both manage infrastructure and reach directory or SaaS data. The fewer identities that span hypervisors, cloud tenants and email, the smaller the blast radius of one compromised path.

Key takeaways

• The article shows that modern intrusions often persist by abusing identity state, not just by maintaining malware on a host.
• WARP PANDA used valid credentials, session tokens, MFA device registration and privileged management paths to expand access across virtual and cloud environments.
• The strongest containment lever is tighter control over session reuse, privileged management accounts and post-login identity changes.

Key terms

• Refresh Token Replay: The repeated use of a long-lived OAuth refresh token to obtain new access tokens without asking the user to authenticate again. It turns a single captured credential into durable session access, which is why revocation speed and token telemetry matter so much in identity governance.
• Management Plane: The administrative layer used to configure, govern, and enforce behaviour across many endpoints or services. A management plane is not the workload itself. It is the control layer above it, which makes it especially sensitive to privileged misuse and delegated automation.
• MFA Device Enrolment Abuse: A post-authentication tactic where an attacker adds a new multi-factor device to make stolen access durable. The risk is not the login itself but the trust reconfiguration that follows, because the new device can become the attacker’s recurring entry point.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.