Joint Advisory Reveals Chinese BRICKSTORM Malware Targeting VMware

Chinese state-sponsored hackers have deployed a sophisticated malware known as BRICKSTORM to infiltrate government, information technology, and critical infrastructure networks, primarily targeting VMware vCenter and ESXi servers, according to a joint advisory from the U.S. Cybersecurity and Infrastructure Security Agency, the National Security Agency, and the Canadian Centre for Cyber Security.

The advisory, released this week, details how the actors, linked to groups such as UNC5221 and tracked as Warp Panda, achieve long-term persistence in victim environments. BRICKSTORM, written in the Go programming language, functions as a backdoor that enables attackers to execute commands, browse file systems, and move laterally across networks. It was first identified in September 2023 by researchers from Mandiant and Google's Threat Intelligence Group, who noted an average undetected dwell time of 369 days in compromised systems.

In one analyzed incident, attackers gained initial access to a public-facing web server, likely through an unconfirmed method, and installed a web shell to remotely execute commands. They then extracted credentials from service accounts to access domain...