Chinese State Hackers Deploy New BRICKSTORM Malware Targeting VMware Systems

Major security agencies have issued an alert regarding the new BRICKSTORM malware, used by Chinese state-sponsored hackers to infiltrate critical systems.

Key Points:

• BRICKSTORM is a backdoor malware targeting VMware vSphere platforms.
• It enables attackers to maintain long-term access to compromised networks.
• Agencies urge organizations to utilize new indicators of compromise for detection.

BRICKSTORM is a sophisticated malware created to provide hackers with a hidden backdoor into critical infrastructure, primarily affecting organizations in government services and IT sectors. Built with the versatile Go programming language, it operates effectively in both Windows and Linux environments. The malware notably targets VMware vSphere platforms, which manage extensive virtual computer networks, allowing attackers to steal sensitive information like usernames and passwords by accessing virtual machine snapshots.

Once the malware is deployed, it ensures persistent control by reinstalling itself if interrupted. This functionality, coupled with multiple layers of encryption to obscure communications, makes BRICKSTORM particularly concerning for cybersecurity professionals. The Cybersecurity and Infrastructure Security Agency (CISA) has analyzed multiple samples of the malware and reported that the hackers typically gain access by infiltrating web servers and exploiting stolen credentials, thus enhancing their control over the affected systems. The ongoing threat has been detected since April 2024, prompting agencies to call for immediate action from all potentially affected organizations.

What measures can organizations take to bolster their defenses against sophisticated malware like BRICKSTORM?

Learn More: Hack Read

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)