---
title: Chinese Hackers Hide in US Networks for Over a Year Using Advanced Malware
description: Warp Panda hacks US firms using BrickStorm malware, exploiting tech vulnerabilities to steal intelligence for China.
canonical_url: https://codekeeper.co/ticker/warp-panda-hacks-us-firms-with-brickstorm-malware
---

# Chinese Hackers Hide in US Networks for Over a Year Using Advanced Malware

Warp Panda hacks US firms using BrickStorm malware, exploiting tech vulnerabilities to steal intelligence for China.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Dec 6, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Chinese hacking group called Warp Panda has been secretly infiltrating US legal, manufacturing, and tech companies since 2022, staying hidden in networks for up to 400 days. The group uses sophisticated malware called BrickStorm that disguises itself as legitimate VMware processes and automatically reinstalls if detected. The hackers exploit vulnerabilities in popular business tools like Ivanti VPN devices and VMware servers to gain initial access, then move through networks using stolen credentials. They've also targeted Microsoft Azure environments and government entities across Asia Pacific. CISA issued an alert Thursday warning that one BrickStorm infection went undetected from April 2024 until September 2025. The persistent attacks appear designed to steal intelligence for China's strategic interests. **Source:** [Security Week](https://www.securityweek.com/us-organizations-warned-of-chinese-malware-used-for-long-term-persistence/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarp-panda-hacks-us-firms-with-brickstorm-malware%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Trezor Users Hit by Phishing After Brevo Platform Hack Sep 14, 2026](https://codekeeper.co/ticker/trezor-customers-phishing-attack-brevo-breach)

[Ransomware Gunra Ransomware Gang Exploits Fortinet Flaws and Bypasses MFA in Global Attacks Aug 14, 2026](https://codekeeper.co/ticker/gunra-ransomware-threatens-global-infrastructure)

[Vulnerabilities CISA Flags ScreenConnect Flaw Exploited Since August Sep 22, 2026](https://codekeeper.co/ticker/cisa-screenconnect-critical-flaw-exploitation)

[Sheffield Hospitals Charity Supporters Hit in Beacon CRM Data Breach Aug 11, 2026](https://codekeeper.co/ticker/sheffield-hospitals-charity-data-breach-alert)