CISA warns of Chinese "BrickStorm" malware attacks on VMware servers
Recorded: Dec. 4, 2025, 8:02 p.m.
| Original | Summarized |
CISA warns of Chinese "BrickStorm" malware attacks on VMware servers News Featured North Korea lures engineers to rent identities in fake IT worker scheme Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets Microsoft "mitigates" Windows LNK flaw exploited as zero-day University of Phoenix discloses data breach after Oracle hack Russia blocks FaceTime and Snapchat over use in terrorist attacks Create compliance docs with this $40 governance & cybersecurity bundle CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Contractors with hacking records accused of wiping 96 govt databases Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityCISA warns of Chinese "BrickStorm" malware attacks on VMware servers CISA warns of Chinese "BrickStorm" malware attacks on VMware servers By Sergiu Gatlan December 4, 2025 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned network defenders of Chinese hackers backdooring VMware vSphere servers with Brickstorm malware. Hackers' lateral movement in the victim's network (CISA) Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Backdoor Sergiu Gatlan Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Marquis data breach impacts over 74 US banks, credit unions Glassworm malware returns in third wave of malicious VS Code packages Sponsor Posts AI is a data-breach time bomb: Read the new report Overdue a password health-check? Audit your Active Directory for free Empowering IT teams with intelligence driven cyber threat research. Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the National Security Agency (NSA) and Canada’s Cyber Security Centre, has issued a critical malware analysis report detailing a sophisticated Chinese hacking campaign targeting VMware vSphere servers. This campaign, spearheaded by the threat actor group tracked as Warp Panda, utilized a backdoor malware strain known as Brickstorm. The objective of this operation was to establish long-term persistence within victim organizations, specifically leveraging VMware’s virtualization platform to create hidden rogue virtual machines. These VMs were designed to evade detection and, crucially, to facilitate the cloning of virtual machine snapshots – a technique used for extracting and stealing credential data. The Brickstorm malware demonstrated a layered approach to security, incorporating advanced obfuscation techniques such as HTTPS, WebSockets, and Nested TLS to secure communication channels. Further complicating detection efforts, the malware utilized a SOCKS proxy for lateral movement across compromised networks, accompanied by DNS-over-HTTPS (DoH) to mask network traffic. A key element of the Brickstorm implant was a self-monitoring function that automatically restarted the malware if it encountered interruptions, ensuring continued operation. The initial discovery of the Brickstorm campaign occurred in April 2024, when CISA investigators identified the malware deployed within the Demilitarized Zone (DMZ) of a victim organization’s network. From this entry point, the attackers initiated lateral movement, ultimately compromising a VMware vCenter server. Simultaneously, they targeted and successfully breached two domain controllers within the victim’s network and exploited a vulnerable Active Directory Federation Services (ADFS) server to extract cryptographic keys. This sustained access, spanning from April 2025 through September 2025, allowed the attackers to consolidate a significant volume of sensitive data. Observations included the theft of Active Directory database information and the execution of system backups, further amplifying the scope of the data exfiltration. To mitigate the threat posed by Brickstorm and similar malware, CISA, alongside the NSA and Cyber Centre, issued specific recommendations for defenders, particularly those safeguarding critical infrastructure and government organizations. These recommendations centered on comprehensive scanning utilizing agency-developed YARA and Sigma rules, as well as proactive monitoring of network edge devices. Network segmentation, restricting traffic from the DMZ to internal networks, was also advised. Furthermore, vigilance regarding unauthorized DNS-over-HTTPS (DoH) providers and external traffic was emphasized, alongside scrutinizing for any signs of Brickstorm. The findings of this report were corroborated by additional intelligence from CrowdStrike, who likewise observed Warp Panda deploying Junction and GuestConduit malware implants within VMware ESXi environments, indicating a sustained and adaptable adversary. Google Threat Intelligence Group (GTIG) had previously identified the Brickstorm malware, first documented by Mandiant in April 2024, employed by suspected Chinese hackers linked to the UNC5221 malicious activity cluster. This cluster was known for exploiting Ivanti zero-days to target government agencies using custom-developed Spawnant and Zipline malware. The Brickstorm campaign underscores the evolving sophistication of cyberattacks and the critical need for robust security measures within virtualized environments. The multi-layered nature of the malware – including encryption, proxy tunneling, and persistent self-monitoring – demonstrates a deliberate strategy designed to evade traditional security controls and maintain persistent access to compromised systems. This analysis highlights the importance of continuous monitoring, proactive threat hunting, and adaptation of security practices to address emerging cyber threats, particularly those originating from state-sponsored actors like Warp Panda. |