CISA Publishes BRICKSTORM Malware Report, Issues New YARA Rules for VMware vSphere

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Canadian Centre for Cyber Security have released an updated malware analysis report on the BRICKSTORM backdoor, now including advanced YARA detection rules specifically targeting VMware vSphere environments.

The report, last updated on January 20, 2026, provides critical insights into this sophisticated threat attributed to China-sponsored cyber actors.​

Security agencies assess that the People’s Republic of China (PRC) state-sponsored cyber actors are deploying BRICKSTORM for long-term persistence on victim systems, primarily targeting organizations in the Government Services, Facilities, and Information Technology sectors.​

BRICKSTORM addressed a highly sophisticated backdoor malware targeting VMware vSphere platforms, specifically VMware vCenter servers and VMware ESXi systems.

The malware comes in multiple variants, with CISA analyzing 11 samples obtained from victim organizations.

Eight samples are Go-based, while the remaining three are Rust-based, demonstrating the threat actors’ advanced development capabilities and adaptability.​

Technical Capabilities

BRICKSTORM maintains stealthy access through multiple sophisticated mechanisms. The malware initiates by running environment checks and maintains persistence using a self-watching function that automatically reinstalls or restarts if disrupted.

After gaining access to vCenter, the cyber actors elevated privileges using the sudo command
[T1548.003], dropped BRICKSTORM malware in the server’s /etc/sysconfig/ directory.

For command and control (C2) communications, BRICKSTORM employs multiple layers of encryption including HTTPS, WebSockets, and nested Transport Layer Security (TLS) to hide communications with actor-controlled C2 servers.​

The backdoor uses DNS-over-HTTPS (DoH) to resolve C2 server addresses by sending encrypted HTTPS requests to legitimate public DoH resolvers including Cloudflare, Google, and Quad9.

This technique allows threat actors to blend malicious traffic with legitimate communications, making detection significantly more challenging.​

BRICKSTORM provides cyber actors with interactive shell access and comprehensive file management capabilities, enabling them to browse, upload, download, create, delete, and manipulate files.

Some variants act as SOCKS proxies, facilitating lateral movement and allowing actors to compromise additional systems within the network.​

The January 2026 update includes six YARA rules designed to detect both Go-based and Rust-based BRICKSTORM samples. These rules target specific malware signatures, file characteristics, and behavioral patterns.

CISA also provides a comprehensive Sigma rule for security information and event management (SIEM) systems, though organizations must ensure their SIEM contains vCenter logs for effective detection.​

Mitigations

At one victim organization where CISA conducted incident response, PRC state-sponsored actors gained long-term persistent access beginning in April 2024.

The actors uploaded BRICKSTORM malware to an internal VMware vCenter server, accessed domain controllers, and successfully compromised an Active Directory Federation Services (ADFS) server, exporting cryptographic keys.

The actors maintained persistent access through at least September 2025.​

CISA urges organizations to implement critical mitigations including upgrading VMware vSphere servers to the latest version, hardening VMware environments following vendor guidance, ensuring proper network segmentation to restrict traffic from demilitarized zones to internal networks.

Organizations that detect BRICKSTORM activity should immediately report findings to CISA through their 24/7 Operations Center or Incident Reporting System, providing incident details to enable tailored incident response assistance.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.