The CISA, the NSA, and Canadian Centre for Cyber Security are warning that the People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems.
You can get more details here: https://www.cisa.gov/news-events/analysis-reports/ar25-338a
Ensar Seker, CISO at threat intel company SOCRadar, provided the following comments:
“The recent advisory from CISA, NSA and the Canadian Centre for Cyber Security (Cyber Centre) confirms that a China‑linked actor is using BRICKSTORM to compromise virtual‑infrastructure environments, creating hidden virtual machines, harvesting credentials via cloned VM snapshots, and maintaining long dwell times of up to 393 days.
What’s especially alarming about this campaign is that it targets the virtualization layer itself, not the OS or applications, which historically receives less attention. Once the hypervisor or management console (vCenter) is compromised, attackers gain broad visibility over the virtual infrastructure and can bypass many traditional endpoint defenses (like EDR), because these often don’t monitor hypervisor behavior or VM snapshot manipulation.
For defenders, the implications are stark: if you run VMware vSphere or ESXi, particularly with vCenter exposed internally or weakly segmented, you are directly in scope. This means organizations must treat virtualization infrastructure as a critical attack surface with the same urgency as public‑facing apps or legacy enterprise systems.
Immediate steps: apply detection signatures/YARA and Sigma rules from the joint CISA/NSA report to hunt for BRICKSTORM indicators; audit VM snapshot creation and export logs; restrict vCenter access tightly; segment management consoles from general workloads; block unauthorized DNS‑over‑HTTPS (DoH) traffic from servers; and ensure build‑in and third‑party monitoring includes hypervisor‑level telemetry.
In short, this isn’t just another malware campaign. It’s a wake‑up call showing that adversaries are shifting upward in the stack, targeting the foundations of virtualization rather than individual VMs. For many organizations, exposure will only be obvious after they start actively hunting for hypervisor‑layer compromise. Let me know if you’d like a short quote or deeper technical breakdown to include.”
Everyone needs to pay attention to this as it is clear from this alert that the bad guys are changing the tactics that they use to get a bigger payoff at the end of the day. Which is bad for all of us and requires immeidate attention from defenders.
Related
This entry was posted on December 5, 2025 at 1:16 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
CISA Warns of Chinese “BrickStorm” Malware Attacks on VMware Servers
The CISA, the NSA, and Canadian Centre for Cyber Security are warning that the People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems.
You can get more details here: https://www.cisa.gov/news-events/analysis-reports/ar25-338a
Ensar Seker, CISO at threat intel company SOCRadar, provided the following comments:
“The recent advisory from CISA, NSA and the Canadian Centre for Cyber Security (Cyber Centre) confirms that a China‑linked actor is using BRICKSTORM to compromise virtual‑infrastructure environments, creating hidden virtual machines, harvesting credentials via cloned VM snapshots, and maintaining long dwell times of up to 393 days.
What’s especially alarming about this campaign is that it targets the virtualization layer itself, not the OS or applications, which historically receives less attention. Once the hypervisor or management console (vCenter) is compromised, attackers gain broad visibility over the virtual infrastructure and can bypass many traditional endpoint defenses (like EDR), because these often don’t monitor hypervisor behavior or VM snapshot manipulation.
For defenders, the implications are stark: if you run VMware vSphere or ESXi, particularly with vCenter exposed internally or weakly segmented, you are directly in scope. This means organizations must treat virtualization infrastructure as a critical attack surface with the same urgency as public‑facing apps or legacy enterprise systems.
Immediate steps: apply detection signatures/YARA and Sigma rules from the joint CISA/NSA report to hunt for BRICKSTORM indicators; audit VM snapshot creation and export logs; restrict vCenter access tightly; segment management consoles from general workloads; block unauthorized DNS‑over‑HTTPS (DoH) traffic from servers; and ensure build‑in and third‑party monitoring includes hypervisor‑level telemetry.
In short, this isn’t just another malware campaign. It’s a wake‑up call showing that adversaries are shifting upward in the stack, targeting the foundations of virtualization rather than individual VMs. For many organizations, exposure will only be obvious after they start actively hunting for hypervisor‑layer compromise. Let me know if you’d like a short quote or deeper technical breakdown to include.”
Everyone needs to pay attention to this as it is clear from this alert that the bad guys are changing the tactics that they use to get a bigger payoff at the end of the day. Which is bad for all of us and requires immeidate attention from defenders.
Share this:
Like this:
Related
This entry was posted on December 5, 2025 at 1:16 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.