Chinese hackers hid in *insufficient logging*; the evidence question nobody asks

The attack

Chinese state-sponsored hackers found a zero-day vulnerability in VMware ESX hypervisors that did something worse than let them in: it stopped the logs from recording what they did ^[1]. At the same time, attackers chained two other flaws—PHP2Shell vulnerabilities and the Fragnesia Linux kernel bug—to gain root access on servers and firewalls ^[1]. Cisco has confirmed that attackers are now crashing its firewalls using a newly disclosed vulnerability, which means affected organisations lose visibility at exactly the moment they need it most ^[1].

It's like a burglar who doesn't just pick the lock but also turns off the security camera on the way in. By the time anyone notices, the footage is already missing.

Why incomplete logs matter

Logs are what tell you what happened during an incident. They're also what supervisors, auditors and insurers ask for when they want to know what you knew, when you knew it and what you did about it.

The trouble is that logs are kept by the same people who could change them, and when an attack crashes a system or a zero-day stops logging from working properly, the logs you do have become even easier to question. Was the log incomplete because the attacker hid their tracks, or because someone tidied it up afterwards? When the evidence is patchy, that question gets harder to answer.

Under DORA, which has applied to financial firms since January 2025, logs must be protected against tampering, deletion and unauthorised access ^[2]. The Swedish Cybersecurity Act, which implements NIS2 and applies from 15 January 2026, requires essential and important entities to report significant incidents in three stages: early warning within 24 hours, incident notification within 72 hours and a final report within a month ^[3]. The Cyber Resilience Act, which will apply to manufacturers of connected hardware and software from 11 September 2026, sets similarly tight deadlines for reporting actively exploited vulnerabilities and serious incidents ^[4].

All three rules count the hours from when you became aware of the incident, not from when it suited you to notice. And they all assume you can show what your systems did.

The evidence question

When a zero-day causes insufficient logging or an attack crashes a firewall, the first question is how to stop it. The second question, which comes later but matters just as much, is how to prove what happened.

If your logs have gaps, or if they cover the incident but could have been edited by someone with administrator rights, an auditor or a supervisor is going to ask the same thing a court would: how do we know this is what actually happened?

That's where the 24-hour and 72-hour clocks start to hurt. You need to report what you know, when you knew it, and the evidence you base that on. If the evidence is a log that could have been changed, or a system that crashed before it could finish logging, your timeline becomes harder to defend.

What this means for you

If you run systems that fall under DORA, NIS2 or the CRA, here are three questions worth asking before the next incident:

• Could you show an auditor or a supervisor that your logs haven't been changed since the incident, even by someone with the right access?
• If a critical system crashes during an attack, do you have a record of what it was doing before it went down?
• When the early warning or incident notification is due in 24 or 72 hours, will you be able to show when you first detected the problem?

Access controls and monitoring are the foundation. An independent record of what was logged, and when, is the part that holds up when the logs themselves are questioned.

Sealing logs as they close

Here, the thing to seal is log segments at short intervals, for example every few minutes. Sealing takes a fingerprint of the segment, not the data itself, so the logs never leave your systems.

If an incident happens and someone later questions whether the logs were complete or unchanged, anyone you share the record with can check that each sealed segment is exactly what was written at that time. Change one character and it won't match.

WitniumChain lets you seal log segments continuously, through the REST API, the SDK or the MCP server, without moving the logs. The fingerprint is sealed on a chain where any later change would show, even one made by us. Internal audit, supervisors and incident responders can check the record. The first 2,000 witnesses a month are free, and the documentation shows how to get started.

It doesn't replace access control, monitoring or backups. What it does is give you a way to show that a log segment existed at a certain time and hasn't changed since, so the timeline you report is one you can defend.

What to watch

15 January 2026: the Swedish Cybersecurity Act, implementing NIS2, comes into force ^[3].

11 September 2026: manufacturers of products with digital elements must start reporting actively exploited vulnerabilities and serious incidents under the CRA ^[4].

11 December 2027: products with digital elements placed on the market after this date must meet the CRA's essential cybersecurity requirements, including logging and monitoring of security-relevant events ^[5].

When logs are incomplete or systems crash during an attack, the evidence question is whether you can show what your systems did. Sealing log segments as they close is one way to make sure the answer is yes.