---
title: CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks
description: CISA warns of cyberattacks by Chinese hackers using Brickstorm malware on U.S. government and IT targets, focusing on VMware systems.
canonical_url: https://codekeeper.co/ticker/cisa-alert-chinese-cyberattacks-vmware
---

# CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

CISA warns of cyberattacks by Chinese hackers using Brickstorm malware on U.S. government and IT targets, focusing on VMware systems.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Dec 5, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

CISA issued an urgent alert Thursday about ongoing cyberattacks by Chinese state-backed hackers targeting U.S. government and IT organizations using the sophisticated Brickstorm backdoor. The attackers are specifically going after VMware vSphere environments, where they can steal virtual machine snapshots and create hidden rogue VMs. The Go-based malware automatically reinstalls itself if disrupted and uses multiple encryption layers to communicate with command-and-control servers. In one documented case, attackers maintained network access from April 11 through September 2, 2024, moving from a web server to domain controllers and eventually VMware systems. CISA recommends keeping VMware servers updated, monitoring for unauthorized VMs, and blocking external DNS-over-HTTPS traffic to prevent these stealth attacks. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/cisa-ongoing-brickstorm-backdoor-attacks)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-alert-chinese-cyberattacks-vmware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Meta Patched a Flaw That Let Attackers Hijack Its AI Agent Sep 22, 2026](https://codekeeper.co/ticker/zero-day-vulnerability-meta-muse-ai-macos)

[LiteSpeed cPanel Plugin Zero-Day Under Active Exploitation Aug 12, 2026](https://codekeeper.co/ticker/critical-zero-day-litespeed-vulnerability)

[Cyberattacks ATF Confirms Cyberattack on System Holding Investigation Target Data Aug 31, 2026](https://codekeeper.co/ticker/atf-cyberattack-qilin-claims-responsibility)

[Vulnerabilities Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox Aug 24, 2026](https://codekeeper.co/ticker/node-js-sandbox-escape-vulnerability)