Hunt: Xen Orchestra VSA-2026-062 exploitation, the empty-token cookie, a pivot2 VM, serial-to-file VMs and zz-ustar cron files

← Threat Hunting · markdown

official (Vates advisory VSA-2026-062 detection section, Nov 10, 2026); Vates says these indicators cover only the campaign seen so far2026-11-11 7:44 AM ET

Hunt: Xen Orchestra VSA-2026-062 exploitation, the empty-token cookie, a pivot2 VM, serial-to-file VMs and zz-ustar cron files

HTTP traffic to Xen Orchestra: requests carrying authenticationToken=j:%7B%7D or authenticationToken=j:{}. Vates warns a WAF regex for this can be bypassed with other encodings.
In Xen Orchestra: a running VM named pivot2.
On XCP-ng hosts: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'; zgrep -- '-serial file:' /var/log/xensource.log*; ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar* (looking for /etc/cron.d/zz-ustar, zz-ustar2, /.ustar5, /.ustar6).
Network: block and search for traffic to 91.211.251.112 (initial, port 8001), 193.148.56.72, 37.221.208.216, 45.66.35.11, 64.65.0.120, 64.65.62.160, 89.47.51.90, 92.60.37.247, and Tor (the actor also used ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333).
If anything hits: assume credential and configuration theft, rotate every secret Xen Orchestra held, and rebuild rather than clean.

Sources: Vates: VSA-2026-062, Empty-object login token (Xen Orchestra, Nov 10, 2026)