BRICKSTORM: The Chinese Secret Service Backdoor Inside U.S. Critical Systems

Javier Conejo del Cerro
hace 12 minutos
3 Min. de lectura

Chinese state-sponsored operatives are quietly infiltrating U.S. critical infrastructure through BRICKSTORM — a stealthy Golang backdoor embedded in VMware and Windows environments — maintaining long-term persistence, bypassing detection with encrypted covert channels, and exfiltrating some of the most sensitive national data. This ongoing espionage campaign demonstrates a strategic effort by the People’s Republic of China to silently occupy the cloud and virtualization backbone that powers both government and industry, reshaping the security paradigm around virtualization security, cloud persistence, and identity compromise at scale.

Phase 1 — Silent Entry Behind the Perimeter Walls

Operators linked to Chinese intelligence are not relying on phishing or noisy ransomware playbooks — they compromise the very servers that manage virtual machines in enterprise environments. BRICKSTORM first appeared during exploitation of Ivanti Connect Secure vulnerabilities and later expanded into attacks on VMware vCenter and ESXi, enabling threat actors to pivot directly into the core of U.S. infrastructure. Their tradecraft focuses on edge-facing devices that serve as cloud gateways, exploiting overlooked vulnerabilities and operational gaps to walk into systems where credentials, identity management, and virtual workloads converge.

Phase 2 — Persistence in the Virtual Shadows

Once inside, the attackers establish BRICKSTORM with precision:

It embeds as a backdoor within ESXi hosts, Windows servers and vCenter
It monitors itself and reinstalls automatically to survive reboots and remediation
It blends into legitimate VMware processes
It uses encrypted and covert command-and-control channels, including DoH, WebSockets and nested TLS
It deploys support implants (Junction, GuestConduit) to tunnel traffic between hosts and guest VMs

The adversary leverages VM socket communications (VSOCK) to ensure lateral movement and exfiltration happen inside the virtualization layer — where conventional EDRs lack visibility.

Infrastructure defenders never see the operators move — yet their domain slowly becomes occupied.

Phase 3 — Data Extraction for State Intelligence

From persistence to espionage, BRICKSTORM’s mission is clear: systematically obtain access to identity, enterprise secrets, and cloud resources.

Targeted Data and Systems Compromised

Administrative credentials and service accounts
Active Directory data and authentication mechanisms
Cryptographic keys and MFA configurations
OneDrive, SharePoint and Exchange emails
Domain controller VMs cloned for full directory access
Cloud identities abused via stolen session tokens

This creates a scenario where China-linked operators no longer need phishing to bypass MFA — they become the identity infrastructure.

The objective is not disruption. It is quiet, strategic and long-term access aligned with PRC national interests.

Victims — A National Supply Chain of Exposure

The campaign has impacted key industries foundational to U.S. governance and commerce:

Government and public sector
Technology providers
Legal and SaaS companies
BPO and managed service providers
Manufacturing entities

By compromising MSPs and SaaS operators, the threat actors expand infiltration into downstream customer networks — multiplying the scope of intelligence access.

These are not opportunistic intrusions. They are structured to provide Beijing continuous leverage.

Phase 4 — Remaining Invisible: A Spy’s Discipline

Warp Panda and UNC5221 employ top-tier OPSEC practices:

Log tampering and timestomping
Rogue VMs that shut down after use
Covert traffic inside VM management channels
Minimal execution artifacts
Precise targeting of employee accounts aligned with PRC interests

The infiltrators do not announce themselves. They wait and watch.

BRICKSTORM represents a tectonic shift in national cyber risk:

Threat actors are embedding themselves into virtualization infrastructure that entire governments depend on. Defensive programs built around endpoint visibility, email security, or MFA alone will not detect an adversary who controls the hypervisor.

China is not breaking the door —

it is becoming the foundation of the building.