CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

CISA warns of ongoing intrusions by Chinese nation-state actors deploying the Brickstorm backdoor in VMware vSphere environments across government and information technology organisations, with the attackers using Brickstorm to retain long-term stealth access.

The campaign, described in a joint malware analysis with the NSA and the Canadian Cyber Security Centre, shows Brickstorm can operate in Windows but recent activity focuses on VMware instances, including use of the vCenter console to steal VM snapshots and create hidden rogue VMs.

The attackers first gained access to the victim network on 11 April 2024 via a Web server in the DMZ, then moved laterally using RDP to a domain controller in the DMZ, before escalating to a second service account and a domain controller in the internal network to reach an Active Directory database. Brickstorm is a Go-based backdoor with self-monitoring to reinstall or restart if disrupted and uses multiple encryption layers and DNS-over-HTTPS to blend C2 traffic with legitimate activity, the report notes.

The attackers reportedly maintained access until 2 September 2025, and while no specific PRC-backed group is yet named, CrowdStrike has linked Warped Panda to several Brickstorm intrusions.