---
title: Hunt: Xen Orchestra VSA-2026-062 exploitation, the empty-token cookie, a pivot2 VM, serial-to-file VMs and zz-ustar cron files | ctxsec
url: https://ctxsec.com/items/hunt-xen-orchestra-vsa-2026-062-empty-token-cookie-pivot2-vm-zz-ustar-cron
description: "Vates published indicators for the campaign exploiting the Xen Orchestra authentication bypass. Successful exploitation leaves no Xen Orchestra log, so detection relies on network captures, unexpected VMs and files the attacker drops on XCP-ng hosts. Vates notes that finding none of these does not prove a host is clean."
status: "official (Vates advisory VSA-2026-062 detection section, Nov 10, 2026); Vates says these indicators cover only the campaign seen so far"
published: 2026-11-11
---

> Vates published indicators for the campaign exploiting the Xen Orchestra authentication bypass. Successful exploitation leaves no Xen Orchestra log, so detection relies on network captures, unexpected VMs and files the attacker drops on XCP-ng hosts. Vates notes that finding none of these does not prove a host is clean.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-xen-orchestra-vsa-2026-062-empty-token-cookie-pivot2-vm-zz-ustar-cron.md)

official (Vates advisory VSA-2026-062 detection section, Nov 10, 2026); Vates says these indicators cover only the campaign seen so far

2026-11-11 7:44 AM ET

### Hunt: Xen Orchestra VSA-2026-062 exploitation, the empty-token cookie, a pivot2 VM, serial-to-file VMs and zz-ustar cron files

- **HTTP traffic to Xen Orchestra:** requests carrying `authenticationToken=j:%7B%7D` or `authenticationToken=j:{}`. Vates warns a WAF regex for this can be bypassed with other encodings.
- **In Xen Orchestra:** a running VM named `pivot2`.
- **On XCP-ng hosts:** `xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'`; `zgrep -- '-serial file:' /var/log/xensource.log*`; `ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*` (looking for `/etc/cron.d/zz-ustar`, `zz-ustar2`, `/.ustar5`, `/.ustar6`).
- **Network:** block and search for traffic to 91.211.251.112 (initial, port 8001), 193.148.56.72, 37.221.208.216, 45.66.35.11, 64.65.0.120, 64.65.62.160, 89.47.51.90, 92.60.37.247, and Tor (the actor also used `ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333`).
- **If anything hits:** assume credential and configuration theft, rotate every secret Xen Orchestra held, and rebuild rather than clean.

Sources: [Vates: VSA-2026-062, Empty-object login token (Xen Orchestra, Nov 10, 2026)](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/)