CISA Releases BRICKSTORM Malware Analysis with New YARA Rules for VMware vSphere

CISA's analysis describes BRICKSTORM, a nation-state linked backdoor that targets VMware vSphere (vCenter and ESXi) to maintain long-term, stealthy access: attackers used stolen service account credentials and RDP to move laterally from compromised web servers to domain controllers and vCenter, exfiltrated keys from ADFS, and employed self-healing persistence and encrypted DNS-over-HTTPS/WebSocket C2; CISA released YARA and Sigma detections and mitigation guidance for affected organizations.