CISA Exposes BRICKSTORM Backdoor Linked to China APTs
Article Content
Browse articles 
CISA has disclosed details about the BRICKSTORM backdoor, which is linked to Chinese state-sponsored threat actors. This backdoor targets VMware vSphere environments within government and technology sectors, enabling long-term persistence on compromised systems. Ongoing cyber-espionage activities by these actors have been highlighted in the report.
Ask AI about this cluster
Answers cite the sources they use
Updated 243d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track Brickstorm in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Chinese Hackers Exploit VMware ESX Logging Flaw as Zero-Day CISA added CVE-2026-41709, a low-severity insufficient logging vulnerability in VMware ESX, to its Known Exploited Vulnerabilities catalog on October 28, 2026. The flaw allows attackers with administrator access to perform operations without logging them, significantly reducing audit trail visibility. CrowdStrike… 
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…