BRICKSTORM backdoor persistent-access activity against VMware vCenter and Windows environments
Malware Activity
Summary
Hide ▲
Show ▼
BRICKSTORM is being used by PRC state-sponsored actors for persistent access in Government and Information Technology organizations, increasing the risk of stealthy compromise across VMware vSphere / vCenter and Windows environments. The malware’s ability to hide communications and move laterally makes it harder to detect and contain. Its built-in resilience also helps it survive disruption and maintain access.
Related Happenings
Remcos RAT variant with real-time surveillance and evasion
Malware Activity
H score28
First: 19.02.2026 18:30
Last: 19.02.2026 18:30
Sources 1
About this happening:
A newly observed Remcos RAT variant now enables real-time surveillance on compromised Windows systems, increasing the risk of immediate webcam monitoring and liv...
Remcos RAT variant with real-time surveillance and evasion
Malware ActivityAbout this happening: A newly observed Remcos RAT variant now enables real-time surveillance on compromised Windows systems, increasing the risk of immediate webcam monitoring and liv...
BRICKSTORM backdoor activity and GRIMBOLT replacement on appliances
Malware Activity
H score29
First: 18.02.2026 12:32
Last: 18.02.2026 12:32
Sources 1
About this happening:
BRICKSTORM is a Golang backdoor used by PRC state-sponsored actors to keep long-term persistence on VMware vSphere, Windows, and appliance environments. ...
BRICKSTORM backdoor activity and GRIMBOLT replacement on appliances
Malware ActivityAbout this happening: BRICKSTORM is a Golang backdoor used by PRC state-sponsored actors to keep long-term persistence on VMware vSphere, Windows, and appliance environments. ...
UNC6201 Dell RecoverPoint for Virtual Machines zero-day campaign
Campaign
H score44
First: 17.02.2026 22:15
Last: 17.02.2026 22:15
Sources 1
About this happening:
The UNC6201 campaign has been exploiting a Dell zero-day since mid-2024, creating a sustained risk of unauthorized access and stealthy movement across victims' virtual...
UNC6201 Dell RecoverPoint for Virtual Machines zero-day campaign
CampaignAbout this happening: The UNC6201 campaign has been exploiting a Dell zero-day since mid-2024, creating a sustained risk of unauthorized access and stealthy movement across victims' virtual...
Latest development: 19.02.2026 17:30
CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure affected Dell RecoverPoint systems by Saturday, February 21, after Mandiant and Google Threat Intelligence Group (GTIG) said UNC6201 had exploited the flaw since at least mid-2024.
Warp Panda North American legal, technology and manufacturing espionage campaign
Campaign
H score32
First: 05.12.2025 16:30
Last: 05.12.2025 16:30
Sources 1
About this happening:
Warp Panda is running a sophisticated cyber-espionage campaign against North American legal, technology and manufacturing firms, maintaining persistent covert access t...
Warp Panda North American legal, technology and manufacturing espionage campaign
CampaignAbout this happening: Warp Panda is running a sophisticated cyber-espionage campaign against North American legal, technology and manufacturing firms, maintaining persistent covert access t...
Warp Panda Brickstorm VMware vCenter targeting campaign
Campaign
H score39
First: 04.12.2025 20:19
Last: 04.12.2025 20:19
Sources 1
About this happening:
A Warp Panda targeting campaign using Brickstorm reached VMware vCenter servers on the networks of U.S. legal, technology, and manufacturing companies throughout *...
Warp Panda Brickstorm VMware vCenter targeting campaign
CampaignAbout this happening: A Warp Panda targeting campaign using Brickstorm reached VMware vCenter servers on the networks of U.S. legal, technology, and manufacturing companies throughout *...
Timeline
-
04.12.2025 14:00 2 articles · 7mo ago
CISA, NSA, and Cyber Centre release BRICKSTORM analysis
Technical Analysis UpdateCISA, the National Security Agency, and the Canadian Centre for Cyber Security released a malware analysis report on BRICKSTORM, a backdoor linked to People’s Republic of China state-sponsored actors and used against VMware vSphere, VMware vCenter servers, and Windows environments. The report includes indicators of compromise, detection signatures, CISA-developed YARA and SIGMA rules, and mitigation guidance for critical infrastructure owners and operators, including network segmentation, edge-device inventory and monitoring, and implementation of Cross-Sector Cybersecurity Performance Goals.
Show sources
- CISA, NSA and Cyber Centre Warn Critical Infrastructure of BRICKSTORM Malware Used by People’s Republic of China State-Sponsored Actors — www.cisa.gov — 04.12.2025 14:00
- CISA, NSA and Cyber Centre Warn Critical Infrastructure of BRICKSTORM Malware Used by People’s Republic of China State-Sponsored Actors — www.cisa.gov — 04.12.2025 14:00