Chinese Hackers Hide in US Networks for Over a Year Using Advanced Malware

Warp Panda hacks US firms using BrickStorm malware, exploiting tech vulnerabilities to steal intelligence for China.

Dec 6, 2025

ON THIS PAGE

A Chinese hacking group called Warp Panda has been secretly infiltrating US legal, manufacturing, and tech companies since 2022, staying hidden in networks for up to 400 days. The group uses sophisticated malware called BrickStorm that disguises itself as legitimate VMware processes and automatically reinstalls if detected.

The hackers exploit vulnerabilities in popular business tools like Ivanti VPN devices and VMware servers to gain initial access, then move through networks using stolen credentials. They've also targeted Microsoft Azure environments and government entities across Asia Pacific.

CISA issued an alert Thursday warning that one BrickStorm infection went undetected from April 2024 until September 2025. The persistent attacks appear designed to steal intelligence for China's strategic interests.

Source: Security Week

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?