China’s WARP PANDA APT Deploys BRICKSTORM Backdoor to Hijack VMware vCenter/ESXi and Azure Cloud

A CrowdStrike researchers have tracked a sophisticated cyber-espionage campaign extending through 2025, attributed to a China-nexus group known as WARP PANDA, which targets VMware vCenter servers and ESXi hosts. According to CrowdStrike, the operation centres on a custom Golang backdoor named BRICKSTORM that masquerades as legitimate vCenter processes such as updatemgr or vami-http, using DoH and nested TLS to conceal communications with C2 servers.

The adversary also deploys two implants: Junction, which listens on port 8090 on ESXi servers to proxy traffic, and GuestConduit, installed inside guest VMs to tunnel traffic back to the hypervisor. The campaign stretches from late 2023 for initial access to cloud environments in late summer 2025, including Microsoft Azure, where attackers exfiltrate browser files to steal session tokens and perform session replay to access OneDrive, SharePoint, and Exchange.

The targeting appears driven by intelligence-collection aims aligned with the PRC, rather than financial crime. Patch coordination for problems in edge devices remains a focus as WARP PANDA’s operations are expected to continue well into the future.