THREAT OPS › Threat News › vSphere and BRICKSTORM Malware: A Defender's Guide
vSphere and BRICKSTORM Malware: A Defender's Guide
<div class="block-paragraph_advanced"><p>Written by: Stuart Carrera</p> <hr /></div> <div class="block-paragraph_advanced"><h3><span style="vertical-align: baseline;">Introduction</span><strong style="vertical-align: baseline;"> </strong></h3> <p><span style="vertical-align: baseline;">Building on </span><a href="https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaig
Attributed threat actors
- Scattered SpiderG1015
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-22769cve
- https://www.stigviewer.com/stigs/vmware_vsphere_70_vcenter_appliance_photon_osurl
- https://www.stigviewer.com/stigs/vmware_vsphere_80_vcenter_appliance_photon_os_40url
- https://www.stigviewer.com/stigs/vmware_vsphere_80_vcenter/2025-06-09/finding/V-258910url
- https://www.stigviewer.com/stigs/vmware_vsphere_70_vcenter/2023-12-21/finding/V-256337url
- https://www.stigviewer.com/stigs/vmware_vsphere_80_vcenter/2025-06-09/finding/V-258921url
- https://stigviewer.cyberprotection.com/stigs/vmware_vsphere_8.0_vcenter/2025-06-09/finding/V-258956url
- https://www.stigviewer.com/stigs/vmware_vsphere_80_vcenter/2025-06-09/finding/V-258968url
- https://knowledge.broadcom.com/external/article/377036/how-to-block-all-traffic-on-vcenter-exce.htmlurl
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23599url
- https://stigviewer.cyberprotection.com/stigs/vmware_vsphere_8.0_vcenter_appliance_photon_os_4.0/2024-07-11/finding/V-266062url
- dministrator@vsphere.localemail
- administrator@vsphere.localemail
- 162.159.140.167ipv4
- 172.66.0.165ipv4