CISA and NSA Warns of BRICKSTORM Malware Attacking VMware ESXi and Windows Environments
The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Canadian Centre for Cyber Security (Cyber Centre) have issued a joint advisory concerning a sophisticated malware campaign attributed to…
The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Canadian Centre for Cyber Security (Cyber Centre) have issued a joint advisory concerning a sophisticated malware campaign attributed to state-sponsored actors from the People's Republic of China (PRC).
The advisory highlights "BRICKSTORM," a backdoor designed to establish persistence within critical government and IT networks, specifically targeting VMware vSphere and Windows environments. BRICKSTORM is a custom Go-based backdoor that employs advanced techniques to evade detection and enable full control over compromised systems.
BRICKSTORM integrates deeply into virtualized infrastructure, targeting VMware vCenter servers and ESXi hosts, allowing manipulation of virtual machines. It uses DNS-over-HTTPS (DoH) for resolving malicious domains through legitimate public resolvers, blending its traffic with normal network traffic. Once a command-and-control (C2) server is located, it establishes a connection using HTTPS, upgraded to a WebSocket connection with additional TLS encryption layers.
The malware's tunneling method employs multiplexing libraries like smux or Yamux , allowing multiple data streams over a single encrypted connection. A reported incident involved PRC actors maintaining access to a network from April 2024 through at least September 2025, beginning with a compromised web server, followed by lateral movement to domain controllers and an Active Directory Federation Services (ADFS) server.
BRICKSTORM is a custom Go-based backdoor that employs advanced techniques to evade detection and enable full control over compromised systems.
Self-Preservation: Features a "self-watcher" function to automatically reinstall the malware if disrupted. Protocol Tunneling: Uses SOCKS proxies for traffic tunneling via TCP, UDP, and ICMP, enabling stealthy lateral movement. Virtualization Targeting: Utilizes Virtual Socket (VSOCK) interfaces for data exfiltration without standard network monitoring.
CISA and partners urge organizations, especially in government and critical infrastructure sectors, to search for BRICKSTORM indicators of compromise (IOCs) immediately. Recommendations include upgrading VMware vSphere servers to the latest versions, limiting network connectivity from edge devices to internal resources, blocking unauthorized DoH traffic, and increasing monitoring on service accounts.
Forensic examinations should be supplemented with disk-based analysis to detect static persistence mechanisms, as BRICKSTORM modifies system initialization files to survive reboots.
Based on reporting by Cyber Security News.