CISA, NSA warn of China’s BRICKSTORM malware after incident response efforts

CISA, NSA and the Canadian Centre for Cyber Security, with private-sector reporting from CrowdStrike and Mandiant, warn of BRICKSTORM — a sophisticated, stealthy backdoor attributed to PRC state-sponsored actors that targets VMware vSphere and Windows to create hidden VMs, harvest credentials, compromise ADFS/domain controllers, and maintain long-term persistence for intelligence collection and data exfiltration across government and technology sectors.