CISA and NSA Warn of BRICKSTORM Malware Attacking VMware ESXi and Windows Environments

The Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), along with Canadian cyber authorities, have issued an urgent joint alert about a dangerous new malware campaign called “BRICKSTORM.”

State-sponsored hackers from China are using this sophisticated tool to infiltrate and hide inside critical government and technology networks.

BRICKSTORM is a backdoor malware that acts like a secret key, allowing attackers to return to compromised systems whenever they want.

The malware specifically targets VMware vSphere virtualization software and Windows environments. By attacking the underlying software that manages corporate servers, hackers can become “ghosts in the machine,” monitoring activity and stealing sensitive data without triggering security alarms.

How the Attacks Work

These attacks are carefully planned and executed. In one confirmed case, hackers gained network access in April 2024 and remained undetected until September 2025.

The attackers initially broke in through vulnerable web servers, then moved through networks using stolen passwords before planting the BRICKSTORM malware.

The malware is particularly difficult to detect because it blends in with normal network traffic. It uses complex encryption to hide communications and disguises commands as regular web activity.

BRICKSTORM also features a “self-watching” capability that automatically reinstalls itself if security programs attempt to remove it, ensuring attackers maintain their foothold.

The campaign focuses on government services, facilities, and information technology sectors. Successful infections can be severe in analyzed attacks, hackers stole critical digital keys that allowed them to impersonate legitimate users and access restricted network areas.

The attackers can even copy entire server snapshots to extract passwords and cryptographic keys.

CISA and NSA urge all organizations, especially critical infrastructure, to immediately search their networks for signs of this threat.

CISA and NSA Warn of BRICKSTORM Malware Attacking VMware ESXi and Windows EnvironmentsThe agencies have released technical signatures that security teams can use to identify the malware.

Administrators should update VMware products immediately, strictly limit access to management systems, and monitor for unusual account activity.

The alert warns that BRICKSTORM is a long-term persistence tool, meaning simply removing the initial infection may not be sufficient if attackers have already embedded themselves deeply in virtualization infrastructure.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates