CISA warns of Chinese "BrickStorm" malware attacks on VMware servers

CISA, NSA, and Canada’s Cyber Centre warn that Chinese-linked actors deployed Brickstorm malware against VMware vSphere/ESXi servers to create hidden rogue VMs, steal cloned VM snapshots and Active Directory data, and maintain long-term persistence (observed April 2024–September 2025); the advisory (corroborated by CrowdStrike and Google reporting) details layered encryption, DoH tunneling, SOCKS proxying, and self-reinstating persistence and provides IOCs and detection guidance (YARA/Sigma, blocking unauthorized DoH, network segmentation) for defenders.