BrickStorm persistence shows why vSphere identity controls matter

At a glance

What this is: BrickStorm is a stealthy backdoor that uses VMware and Windows pathways to maintain persistence, steal credentials, and move laterally while hiding its command and control traffic.

Why it matters: It matters because virtualization layers often sit outside mature identity governance, yet they expose service accounts, privileged access, and snapshot data that can be abused across NHI and human identity programmes.

By the numbers:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%).

👉 Read SafeBreach's analysis of the BrickStorm backdoor and updated CISA guidance

Context

BrickStorm is a backdoor built for persistence and stealth inside virtualised environments, not a noisy smash-and-grab tool. The CISA, NSA, and Canadian Centre for Cyber Security analysis makes clear that attackers used valid credentials, hidden execution paths, and covert network channels to stay resident in VMware vSphere and Windows estates while avoiding routine detection.

For IAM, PAM, and NHI teams, the important point is that virtualisation platforms concentrate privilege in service accounts, administrative tokens, and snapshot access. That creates an identity governance problem as much as a malware problem, because the same access paths that support operations can also support credential theft, lateral movement, and silent persistence. This pattern is now typical in espionage-grade intrusion sets, not an edge case.

Key questions

Q: What breaks when service accounts have broad access in virtualized environments?

A: Broad service account access turns virtualization management into a persistence and lateral movement layer. If an attacker steals one trusted identity, they can often reach snapshots, boot scripts, and admin interfaces without triggering obvious authentication failures. The control failure is not only over-privilege, but the absence of strict separation between operational access and high-impact management actions.

Q: Why do vSphere environments need identity governance as much as malware detection?

A: Because the attacker’s durable foothold often comes from trusted identities, not from a single executable. When management-plane accounts, snapshot permissions, and remote admin paths are loosely governed, malware can blend in with legitimate administration. Identity governance defines who can do what, while detection only explains what happened after the fact.

Q: What do security teams get wrong about encrypted command and control traffic?

A: They often assume encryption is the core problem, when the real issue is encrypted traffic from systems that should not be talking that way. A backdoor can hide inside HTTPS, WebSockets, or DNS-over-HTTPS and still be operationally abnormal. Teams need context about the asset, the identity, and the expected behaviour, not just packet content.

Q: Who is accountable when hidden VMs or snapshot theft appear in a breach?

A: Accountability usually spans infrastructure, IAM, and security operations because the failure cuts across administrative access, monitoring, and platform hardening. If snapshot access, service account scope, or vCenter logging were not governed tightly, the issue is not only malware response. It is a control ownership problem that should be assigned before the next incident.

Technical breakdown

How BrickStorm establishes persistence in vSphere environments

BrickStorm is designed to survive reboots, process termination, and routine clean-up. CISA describes modified VMware init scripts, executable copying, environment-variable checks, self-watching logic, and PATH hijacking, all of which let the backdoor reassert itself inside vCenter and ESXi estates. The malware also masquerades as legitimate VMware binaries, which reduces the chance that a basic file or process scan will catch it. In practice, this means persistence lives in both the filesystem and the operational assumptions around trusted platform components.

Practical implication: monitor startup scripts, binary naming, and process respawn behaviour as control points, not just endpoint detections.

Why credential theft and lateral movement are tightly coupled here

BrickStorm does not rely on a single access path. The report links the campaign to valid service account credentials, RDP, MSP access, and credential extraction from VM snapshots and NTDS.dit. It also includes SOCKS proxy capability, which turns a compromised foothold into a relay point for movement across adjacent systems. This is a classic privilege reuse problem: once an attacker gets one trusted identity, the environment often supplies the rest of the path. In virtualised infrastructure, that makes service account governance and snapshot protection part of the attack surface.

Practical implication: treat service accounts, snapshot permissions, and remote admin paths as high-risk identity controls requiring tighter scoping and review.

How BrickStorm hides command and control traffic

BrickStorm uses DNS-over-HTTPS, nested TLS, and WebSockets to obscure its command and control traffic, while also blending into normal web activity with HTML, CSS, and JavaScript content. That combination makes network controls harder to tune because the traffic can resemble routine encrypted application chatter. The malware also uses hard-coded cryptographic keys and multiplexed channels to keep the session resilient. The technical takeaway is that encryption alone is not suspicious, but encrypted traffic from a virtualization management plane should be treated as a high-value signal when it behaves like an implant rather than an admin tool.

Practical implication: inspect DoH usage, encrypted management-plane egress, and unusual WebSocket patterns as part of detection engineering.

Threat narrative

Attacker objective: The objective is durable espionage access to virtualised environments, including credential material, hidden persistence, and stealthy exfiltration routes.

1. Entry begins with compromised web shells, valid service account credentials, or MSP credentials that provide access into DMZ or vCenter-adjacent systems.
2. Escalation comes from credential theft, snapshot access, and relay capability, which allow the attacker to pivot deeper into Windows and VMware environments.
3. Impact follows through long-term persistence, stealthy command and control, file manipulation, and exfiltration of data from virtual infrastructure.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

BrickStorm is an identity governance problem hiding inside a malware story. The report shows that persistence in virtualisation estates depends on trusted access paths, not only executable code. Service accounts, snapshot permissions, and management-plane credentials become the real control surface. For IAM and PAM teams, that means vSphere should be treated as a privileged identity environment, not a separate infrastructure domain.

Standing privilege in virtualization layers creates a persistence window that attackers exploit. BrickStorm benefits from long-lived accounts, broad admin reach, and operational exceptions that are often left outside routine review. The control gap is not just weak detection, but the assumption that high-trust accounts can remain broadly usable without frequent constraint changes. Practitioners should view this as a failure of privilege lifecycle management.

Virtualization-plane secrecy: the malware succeeds because encrypted management traffic and trusted admin behaviour are hard to distinguish without context. This is where NHI governance intersects with cloud and infrastructure security, because machine identities and service accounts are often the only actors with enough access to make persistence durable. Security teams need policy around who can touch snapshots, boot scripts, and management APIs.

BrickStorm validates why anomaly detection must be paired with identity-aware controls. Network inspection alone will miss a backdoor that uses legitimate credentials, DoH, and WebSockets. The field should read this as evidence that access governance, not just telemetry volume, determines whether stealthy intrusion sets remain visible. Practitioners should re-centre on credential scope, privileged path review, and management-plane segmentation.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%).
• This makes NHI lifecycle governance the next control layer to examine, especially where service accounts and management-plane credentials support privileged infrastructure access. See NHI Lifecycle Management Guide for the operational model.

What this signals

BrickStorm should push practitioners to treat virtualization management as part of the identity plane, not as a separate operations problem. When service accounts can reach boot scripts, snapshots, and remote access tools, compromise can persist even after malware removal. The practical shift is toward tighter privileged-path review, stronger logging on management interfaces, and explicit control over what identities can touch.

Privileged path collapse: this is the point where one trusted identity can unlock persistence, lateral movement, and exfiltration across an entire platform layer. That matters for NHI governance because machine and service identities often carry broader reach than their human counterparts. The reader response is to reduce standing trust, segment management access, and examine where encrypted traffic is masking administrative abuse.

Teams should also expect attackers to continue targeting the gap between infrastructure telemetry and identity governance. Alerting on unusual network patterns is not enough if the underlying account model still permits broad reuse. Aligning management-plane controls with NHI lifecycle discipline gives defenders a way to constrain the blast radius before a backdoor can establish durable residence.

For practitioners

• Tighten service account scope in virtualization estates Inventory every account that can administer vCenter, ESXi, snapshot access, or remote access paths. Remove standing broad privileges, separate admin roles from operational roles, and review accounts that can reach both DMZ and internal networks.
• Block covert DNS-over-HTTPS pathways Restrict approved DoH resolvers and alert on encrypted DNS egress from servers that should not initiate it. Pair that with proxy and firewall rules that treat management-plane systems differently from user endpoints.
• Harden startup and persistence locations Watch VMware init scripts, PATH order, and binary naming conventions for unexpected changes. Add integrity checks for files that control service startup and process respawn behaviour, because BrickStorm uses those locations to survive cleanup.
• Review snapshot and NTDS.dit access pathways Limit who can create, export, or inspect VM snapshots and who can access domain-controller artifacts. These are credential-rich assets, and in this campaign they are part of the theft path rather than a post-incident afterthought.

Key takeaways

• BrickStorm shows that virtualization-layer persistence is often an identity governance failure as much as a malware failure.
• The campaign’s effectiveness depends on trusted service accounts, snapshot access, and management-plane abuse, which makes privilege scope a primary control point.
• Defenders should pair malware detection with tighter NHI lifecycle controls, encrypted-traffic inspection, and management-plane hardening.

Key terms

• Management-Plane Identity: A management-plane identity is any human or non-human account that can administer devices, identity providers, or security policy. These identities carry outsized risk because abuse can cascade across many systems from a single trusted account or token.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.
• Snapshot theft: Snapshot theft is the unauthorised access or export of a virtual machine snapshot to recover memory, files, or credentials from the captured state. It is especially dangerous because snapshots can contain authentication material and operational secrets that were never meant to be copied outside the platform.

What's in the full article

SafeBreach's full post covers the operational detail this analysis intentionally leaves for the source:

• Simulation coverage mapped to specific BrickStorm techniques across initial access, persistence, privilege escalation, command and control, and exfiltration.
• A concrete list of updated behavioral attacks that practitioners can run against their own environments to test detections.
• Platform-specific instructions for running the new BrickStorm scenarios on demand.
• The playbook update path for coverage as new indicators and variants emerge.

👉 The full SafeBreach post covers the attack techniques, detection coverage, and simulation updates for BrickStorm.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle control to the broader security programmes their environments depend on.