Cybercriminals linked to China have targeted government entities with the BRICKSTORM malware

The United States and Canada are warning about this malicious software, designed to ensure “stealthy persistence” in infected information systems.

U.S. and Canadian authorities issued an alert on December 4, 2025, about a campaign conducted by cybercriminals affiliated with China, using the BRICKSTORM malware to target government entities. CISA and the Canadian Centre for Cyber Security, the U.S. and Canadian equivalents of France’s ANSSI, released this security advisory in collaboration with the U.S. National Security Agency (NSA).

The document is based on the analysis of eight samples collected from organizations victimized by this “sophisticated and stealthy malware.” The cybercriminals primarily targeted VMware vSphere and Windows environments, where they were able to create virtual machines. BRICKSTORM enabled them to “browse, download, create, delete, and manipulate files,” as well as perform lateral movement.

The malware includes a “self-monitoring” feature that allows it to reinstall or automatically restart itself in the event of disruptions, making it particularly formidable.