BrickStorm exposes the blind spot problem in modern enterprise defense

At a glance

What this is: BrickStorm is a stealthy espionage campaign that uses appliance, virtualisation, and credential abuse to stay hidden for an average of 393 days.

Why it matters: It matters because identity and security teams need to account for access paths that bypass endpoint controls, especially where privileged infrastructure and credential material are concentrated.

By the numbers:

• the astonishing average time they remain inside a victim’s network before being detected is well over a year, 393 days to be exact

👉 Read SafeBreach’s analysis of the BrickStorm campaign and 393-day dwell time

Context

BrickStorm is a reminder that modern enterprise defence fails when visibility stops at the endpoint. The campaign exploits edge appliances, virtualisation infrastructure, and credential stores that often sit outside normal monitoring, which makes the primary problem blind spots in control coverage rather than simple malware detection. For identity programmes, that means privileged access and machine credentials in infrastructure layers deserve the same scrutiny as user logins.

The article’s key point is that a patient attacker can blend into background activity, move through trusted management planes, and harvest credentials without triggering the controls many organisations still treat as sufficient. That is a familiar pattern in NHI-heavy environments, where service access, admin credentials, and platform trust can outlive the detection window. This is not an edge case; it is the expected outcome when governance assumes visibility that does not exist.

Key questions

Q: What breaks when attackers can hide in appliance and virtualisation layers?

A: Traditional endpoint-centric detection breaks first, because the malicious activity happens on systems that either cannot host EDR or are not instrumented with enough depth. The defender loses visibility into the management plane, which is where attackers can clone systems, extract credentials, and persist without touching the live host.

Q: Why do management-plane identities create such a large attack surface?

A: Management-plane identities often control hypervisors, backups, orchestration, and directory access at once, so one compromise can unlock many downstream assets. These identities are especially dangerous when they carry standing privilege or broad trust, because attackers can use legitimate access patterns instead of noisy exploit chains.

Q: How do security teams know whether virtualisation blind spots are still open?

A: Look for privileged actions that are not producing matching alerts, such as VM cloning, disk mounting, and unusual control-plane logins. If those events are not centrally correlated, your environment may be visible at the host layer but still opaque at the orchestration layer, which is where this campaign operates.

Q: Who is accountable when an attacker persists through trusted infrastructure for months?

A: Accountability usually sits with the teams that own the management plane, identity controls, and incident validation process, not only the endpoint or SOC teams. Frameworks such as NIST CSF and NIST SP 800-53 place responsibility on access control, audit, and continuous monitoring, which is where long-dwell campaigns are decided.

Technical breakdown

How appliance compromise bypasses endpoint controls

BrickStorm targets internet-facing appliances such as VPN gateways, vCenter, and ESXi hosts because these systems often cannot run standard EDR agents. Once the attacker lands on an appliance, the activity occurs in infrastructure layers that many organisations monitor weakly or not at all. That creates a structural gap: the attack is real, but the usual endpoint telemetry never appears. The result is a blind spot around management infrastructure, where compromise can persist without the alerts defenders expect from workstation or server intrusion.

Practical implication: extend detection coverage to appliance logs and management-plane telemetry, not just endpoints.

Why virtualisation enables credential theft without touching the live host

The campaign’s credential theft method uses a compromised vCenter to clone a virtual machine, mount the offline disk, and extract the Active Directory database from the clone. This avoids direct interaction with the live domain controller, which means security tooling on the production host may never observe the file access. Technically, the attacker is exploiting the trust boundary between orchestration systems and guest systems, then using offline access to recover credentials with minimal forensic residue. That makes virtualisation control planes a high-value identity-adjacent target.

Practical implication: protect vCenter and similar orchestration layers with stronger monitoring, isolation, and privileged access controls.

What delayed activation changes about dwell time and persistence

BrickStorm reportedly deployed implants that stayed dormant for months before resuming communication, including after incident response had started. Delayed activation is a persistence technique because it lets attackers outlast the first containment effort and return when defenders believe the environment is clean. In operational terms, this turns remediation into a timing problem as much as a detection problem. If defenders only validate the environment during the active response window, dormant implants can survive and re-establish command later.

Practical implication: validate eradication over time, not only during the first cleanup cycle.

Threat narrative

Attacker objective: The attacker seeks prolonged espionage access, credential material, and downstream supply chain leverage from trusted infrastructure.

1. Entry occurs through a zero-day or similar flaw on an internet-facing edge appliance, giving the attacker access to infrastructure that sits outside normal endpoint coverage.
2. Escalation follows when the attacker uses the compromised management plane to clone virtual machines and extract credential material without touching the live production host.
3. Impact comes from long-dwell espionage, credential-based lateral movement, and slow exfiltration from trusted infrastructure, allowing the campaign to persist for months without detection.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

BrickStorm shows that blind spots are now a primary control failure, not an operational inconvenience. When attackers can live on appliances and management planes that EDR cannot see, the security model has already failed at the visibility layer. This changes the governance question from "can we detect malware" to "which trusted systems remain outside our control boundary." For practitioners, the lesson is to treat infrastructure visibility as a first-class security requirement.

Credential theft from virtualisation layers is an identity problem as much as a cloud or infrastructure problem. A compromised vCenter becomes a launch point for harvesting credentials that were assumed to be protected by host-based controls. That is an NHI governance issue because service access, admin accounts, and orchestration trust are all part of the same access graph. Management-plane trust gap: when orchestration systems are over-trusted, attackers can bypass the live system and steal identity material offline. Practitioners should re-map privileged dependencies across the control plane.

Long dwell time exposes the weakness of response models that assume attackers stay active while you investigate. Dormant implants and delayed callbacks exploit the gap between containment and true eradication. The operating assumption that a clean incident response window equals removal is too optimistic. For security leaders, this means validation has to continue after the first response cycle, especially in environments where adversaries can re-enter through management infrastructure.

The supply chain risk here is not only downstream dependency, but upstream compromise of the software makers themselves. The article’s “steal today, weaponize tomorrow” pattern reflects how espionage can become a vulnerability-development pipeline. That is especially relevant for identity programmes because vendors, SaaS platforms, and orchestration layers often hold the credentials and trust relationships that attackers prize most. Practitioners should assume that trusted providers are also potential credential concentration points.

Detection engineering must now include the behaviour of infrastructure identities, not only human users. The campaign succeeds because the attacker acts through accounts and systems that look legitimate when measured against the wrong baseline. That makes NHI governance and privileged access policy central to defence, even in what appears to be a pure infrastructure intrusion. Teams need to define what normal looks like for management-plane identities before they can detect abuse.

From our research:

• only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
• The 52 NHI breaches Report shows how weak identity governance keeps showing up as the common failure mode across real incidents.

What this signals

Blind-spot management is now a measurable programme risk, not an abstract architecture concern. If your monitoring strategy stops at endpoints, you have not solved the problem this campaign illustrates. Teams should build control-plane coverage into their detection roadmap and validate whether privileged infrastructure actions are observable before an attacker tests them first.

Management-plane identities need a governance model that matches their blast radius. In practice, that means treating hypervisor admins, orchestration accounts, and service credentials as high-impact non-human identities, even when they are not part of the usual IAM conversation. The most dangerous access paths are often the ones that look operational rather than identity-centric. For practitioners, the next step is to map those identities into the same risk review process used for privileged human access.

393 days is not just a dwell-time statistic, it is a warning about validation latency. If an adversary can remain active for that long, then periodic checks are insufficient unless they are designed to catch delayed persistence and offline credential theft. That should push programmes toward continuous validation, better appliance telemetry, and tighter access control around management systems.

For practitioners

• Map management-plane blind spots Inventory appliances, hypervisors, and orchestration systems that cannot run EDR, then define compensating log sources and alert paths for each one. Prioritise vCenter, ESXi, VPN, and adjacent control planes where attacker activity can occur outside endpoint visibility.
• Harden virtualisation-based credential paths Restrict who can clone virtual machines, mount offline disks, or access hypervisor management functions, and monitor those actions as privileged events. Treat offline disk access to identity stores as a high-severity signal because it bypasses the live host entirely.
• Validate dormant persistence after response Run follow-up hunts and re-validation after incident response closes, with special attention to delayed beaconing and long-interval callbacks. Confirm eradication across multiple time windows rather than assuming the absence of immediate alerts means removal.
• Review trust in service and admin accounts Audit service accounts, orchestration accounts, and platform administrators for standing privilege and overly broad access to identity stores, backups, and hypervisors. Remove unnecessary reach before an attacker can use legitimate access for lateral movement.
• Simulate appliance and control-plane abuse Test whether your detections can distinguish legitimate management activity from attacker movement through appliances and virtualisation layers. Correlate logs from hypervisors, directory services, and network controls to prove that the chain is visible before a real campaign uses it.

Key takeaways

• BrickStorm demonstrates that defenders can lose the fight before the alert ever fires when attackers operate on appliances and management planes outside EDR coverage.
• The campaign’s 393-day dwell time shows how long an attacker can remain inside trusted infrastructure when visibility, credential controls, and validation are misaligned.
• Practitioners should harden control-plane identities, close appliance blind spots, and re-check eradication after response because the longest persistence often begins where monitoring ends.

Key terms

• Management Plane: The administrative layer used to configure, govern, and enforce behaviour across many endpoints or services. A management plane is not the workload itself. It is the control layer above it, which makes it especially sensitive to privileged misuse and delegated automation.
• Coverage Blind Spot: A coverage blind spot is any part of the environment where monitoring does not see data movement, storage, or sharing activity. For DLP, blind spots often appear in SaaS services, collaboration tools, APIs, and unmanaged workflows that fall outside older perimeter-based designs.
• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• Delayed activation: Delayed activation is a persistence technique where malware or implants remain dormant before communicating or executing later. It helps attackers outlast incident response, evade quick cleanup, and reappear after defenders believe the environment has been cleared.

What's in the full article

SafeBreach's full blog covers the operational detail this post intentionally leaves for the source:

• Exact detection test scenarios for identifying offline VM cloning in vCenter and similar control planes
• Examples of network telemetry that should flag suspicious appliance traffic, including DNS over HTTPS from infrastructure that should not generate it
• SafeBreach Exposure Validation Platform guidance for testing whether your environment can detect in-memory credential theft on a vCenter server
• Recommended workflows for validating blind spots in IT and OT environments without relying on endpoint agents

👉 SafeBreach’s full post covers the attack chain, blind-spot testing, and detection considerations in more detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme that depends on them.