CISA warns of Chinese BrickStorm attacks on VMware servers

Du'aine Davis

Observed in the wild

• Between April 2024 and 3 September 2025, PRC state-sponsored actors deployed the BRICKSTORM backdoor to maintain persistent access in a government/IT-sector organisation. They compromised multiple systems, including a DMZ web server, domain controllers, an ADFS server (stealing cryptographic keys), and a VMware vCenter server.
• The intrusion began with a web shell on a DMZ server, followed by credential theft and RDP/SMB lateral movement. BRICKSTORM, an ELF Go-based backdoor, was installed on vCenter using init scripts in /etc/sysconfig/. It leverages DNS-over-HTTPS (DoH), TLS/WebSockets, SOCKS proxy, and custom persistence with self-monitoring loops to evade detection.
• Organisations should monitor for unexpected init scripts in VMware, unusual binaries in /etc/sysconfig/, encrypted DoH lookups, WebSocket traffic, and SOCKS proxy sessions.

BRICKSTORM Backdoor | CISA

Du'aine Davis

WARP PANDA Deploys BRICKSTORM for Persistent Cloud Intrusions
Observed in the wild

• From late 2023 through summer 2025, WARP PANDA, a China-nexus threat actor, breached US legal, technology, and manufacturing organisations. They sustained long-term access to VMware vCenter and ESXi environments and later infiltrated Microsoft Azure to compromise Microsoft 365 services. Victims included personnel linked to PRC strategic priorities.
• WARP PANDA exploited Ivanti, F5 BIG-IP, and VMware vCenter flaws (e.g., CVE-2024-21887, CVE-2023-34048), using stolen credentials and web shells for initial access. BRICKSTORM was central to persistence, installed on vCenter and ESXi hosts via init scripts and custom implants. It leveraged DNS-over-HTTPS, TLS/WebSockets, SOCKS proxying, and self-monitoring loops to evade detection. Additional tools included Junction and GuestConduit for ESXi and guest VMs, enabling stealthy lateral movement and covert tunnelling.
• Monitor for BRICKSTORM indicators: unexpected init scripts in VMware, anomalous binaries in /etc/sysconfig/, encrypted DoH queries, and WebSocket traffic. Audit ESXi for unsanctioned VMs and nonstandard ports (e.g., 8090), and enforce MFA for vCenter. Apply strict segmentation, disable shell access for vpxuser, and patch vSphere promptly.

Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary