CISA/NSA Warn of BRICKSTORM Backdoor: China APT Targets VMware and ADFS for Long-Term Espionage

According to The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the Canadian Centre for Cyber Security, BRICKSTORM is a sophisticated backdoor used by actors linked to the PRC for long-term persistence. The malware targets VMware vSphere (including vCenter servers and ESXi) and Windows systems, enabling attackers to steal cloned VM snapshots for credential extraction and to create hidden rogue VMs.

It features a self-watching function that reinstalls or restarts if disrupted and hides its communications by layering HTTPS, WebSockets and nested TLS, even using DNS-over-HTTPS to blend with legitimate traffic. The incident described saw BRICKSTORM deployed starting with a web shell on an external-facing server, followed by lateral movement to compromise a domain controller and an Active Directory Federation Services (ADFS) server.

The attackers reportedly compromised the ADFS server and exported cryptographic keys, maintaining a foothold in the victim’s network for nearly 18 months, from April 2024 through September 2025. Organizations, especially in government and IT sectors, are urged to hunt for this threat using the provided IOCs and YARA rules.