BRICKSTORM Malware Campaign UPDATE: What Else You Need To Know

In September 2025, we issued a client alert warning about the BRICKSTORM malware campaign and recommended steps to strengthen your organization's defenses. On Dec. 4, 2025, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency, and Canadian Centre for Cyber Security released a report, Malware Analysis Report AR25‑338A (BRICKSTORM Backdoor), which confirms our initial assessment and provides expanded technical details, detection signatures, and mitigation guidance.

The report concludes that People's Republic of China state-sponsored actors are deploying BRICKSTORM to achieve long-term persistence in VMware vSphere (vCenter/ESXi) and Windows environments. The primary targets appear to be government services and facilities, along with information technology companies supporting this sector. If you operate in these areas, remain vigilant and review the details below carefully. Please note, this is a very stealthy attack and without