BRICKSTORM Malicious IP Communication

Georg Lauenstein@gsec

•updated Apr 3, 2026•1•0•111

Detects network communication to IP addresses associated with BRICKSTORM malware operations targeting vSphere environments. These IPs have been observed in active campaigns compromising VMware vCenter and ESXi infrastructure.