PRC spies Brickstormed their way into critical US networks and remained hidden for years

Government and private security firms warn that PRC-linked actors (UNC5221 / Warp Panda) have used the multi-platform Brickstorm backdoor and additional Go-based implants to gain persistent, long‑dwell access in VMware, Linux and Windows environments—compromising vCenter, domain controllers, cloud accounts and Microsoft 365 data across multiple US government, IT, and private-sector organizations, with dozens of victims observed and ongoing active targeting of downstream services.