← Back to Feed

vSphere and BRICKSTORM Malware: A Defender's Guide

April 2, 2026 · Google Cloud Security · Severity: CRITICAL

vSphere and BRICKSTORM Malware: A Defender's Guide. Written by: Stuart Carrera Introduction Building on recent BRICKSTORM research from Google Threat Intelligence Group (GTIG), this post explores the evolving threats facing virtualized environments. These operations directly target the VMware vSphere ecosystem, specifically the vCenter Server Appliance (VCSA) and ESXi hypervisors. To help organizations stay ahead of these risks, we will focus on the essential hardening strategies and mitigating controls necessary to secure these critical assets. Organizations should treat this as an active threat and take immediate defensive action.

Key Takeaways

  • Analysis reveals how vSphere and BRICKSTORM Malware infects and persists on target systems.
  • Critical severity rating indicates active exploitation risk requiring immediate remediation across affected environments.
  • Endpoint detection and response (EDR) tools combined with behavioral analysis can detect advanced malware early in execution.
☕ Buy a Coffee