US Organizations Warned of Chinese Malware Used for Long-Term Persistence

Warp Panda, a China-linked threat actor, has been using BrickStorm, Junction, and GuestConduit malware in attacks against US organisations to maintain long-term access. According to SecurityWeek, the group focuses on persisting within compromised networks, exploiting edge devices for initial access and then moving laterally to VMware vCenter servers using valid credentials or known vulnerabilities.

The campaign has included the use of SSH and the privileged vCenter account vpxuser for lateral movement, SFTP for data transfer, and tunnelling traffic through BrickStorm, with activity observed since at least 2022. BrickStorm, designed to masquerade as legitimate vCenter processes, was described by Google as being attributed to the China-linked group UNC5221, and CrowdStrike notes Warp Panda is the only actor known to have used BrickStorm so far, though it may be used by multiple China-nexus actors.

On 4 December 2025, the US cyber security agency CISA issued an alert about BrickStorm activities targeting government, facilities, and information technology organisations, noting the malware provides long-term persistence and has remained undetected for extended periods, including a VMware vCenter deployment in April 2024 that was not detected until at least September 2025.