Securing vSphere Against BRICKSTORM: A Step-by-Step Hardening Guide

Introduction

As recent research by Google Threat Intelligence Group (GTIG) highlights, the BRICKSTORM malware campaign represents a sophisticated threat to virtualized environments, specifically targeting VMware vSphere components like the vCenter Server Appliance (VCSA) and ESXi hypervisors. Attackers establish persistence at the virtualization layer, operating beneath guest operating systems where traditional security tools like endpoint detection and response (EDR) are ineffective. This guide provides a structured, step-by-step approach to hardening your vSphere infrastructure against such threats. By following these measures, you can close visibility gaps, enforce strong identity controls, and transform the virtualization layer into a resilient defense. For automated enforcement, Mandiant offers a vCenter Hardening Script that applies these configurations at the Photon Linux layer. Let's get started.

What You Need

• Administrative access to the vCenter Server Appliance (VCSA) and managed ESXi hosts.
• vSphere Client or SSH access to the VCSA command line (for script deployment).
• Knowledge of current network architecture and existing security policies.
• Backup of critical VM snapshots and VCSA database before making configuration changes.
• Optional: Access to Mandiant’s vCenter Hardening Script (if using automation).
• Privileged access management (PAM) or similar tools for credential vaulting.
• Monitoring tools (SIEM, syslog server) capable of ingesting vSphere logs.

Step-by-Step Hardening Guide

1. Step 1: Classify the VCSA as a Tier-0 Asset

   The vCenter Server Appliance controls the entire vSphere environment. Because it often hosts Tier-0 workloads like domain controllers or PAM solutions, treat it as the most sensitive asset. Update your asset inventory to reflect this classification. Ensure that all security policies, change management, and access controls for Tier-0 systems apply to the VCSA. This step sets the foundation for all subsequent hardening.

2. Step 2: Enforce Strong Identity and Access Controls

   Threat actors exploit weak identity design. Implement the following:

   • Use vCenter Single Sign-On (SSO) with multi-factor authentication (MFA) where possible.
   • Configure role-based access control (RBAC) to limit administrative privileges. Use the principle of least privilege – grant only necessary permissions.
   • Audit all service accounts and remove any that are unnecessary.
   • Integrate with an external identity provider (e.g., Active Directory, LDAP) for centralized management, but avoid using built-in vCenter credentials.
   • Enable password policies (complexity, expiration) within vCenter and the Photon OS.

3. Step 3: Harden the Photon Linux Operating System

   The VCSA runs on Photon Linux. Out-of-the-box defaults are insufficient. Perform these actions:

   • Apply the latest security patches to Photon OS and VCSA components.
   • Disable unnecessary services (e.g., unused network protocols, SNMP if not needed).
   • Configure the host-based firewall ( iptables or firewalld ) to allow only essential ports (e.g., 443, 443 for vCenter, 22 for SSH access if necessary, but restrict to specific management IPs).
   • Enable audit logging for system calls and user activity using auditd.
   • Harden SSH: disable root login, use key-based authentication, and change the default port if possible.
   • Set file permissions correctly on configuration files (e.g., /etc/vmware-marvin, /var/log/vmware).

   Consider using Mandiant’s vCenter Hardening Script (see Step 6) to automate many of these settings.

4. Step 4: Secure the ESXi Hypervisors

   ESXi hosts are the execution layer. Protect them by:

   • Enabling lockdown mode for all hosts. This denies direct console access and forces all management through vCenter.
   • Configuring host resource isolation using DRS rules to separate sensitive VMs from others.
   • Disabling unused services on the hypervisor, such as the ESXi Shell (SSH) and DCUI (Direct Console User Interface) unless absolutely needed, and then only for administrative sessions.
   • Applying security profiles via Host Profiles in vSphere to standardize configurations across the cluster.
   • Using vCenter Server Access Control to restrict which users can manage ESXi settings.

5. Step 5: Establish Centralized Logging and Monitoring

   Visibility is critical. Implement:

   

   • Forward all vCenter and ESXi logs to a SIEM (Security Information and Event Management) system. Focus on authentication logs, system changes, and privilege escalations.
   • Configure SNMP traps or RESTful APIs for real-time alerts on security events.
   • Enable vCenter performance and health monitoring to detect anomalies.
   • Set up alerts for new user creation, permission changes, unusual time stamps, and failed logins.
   • Review audit logs daily or use automated correlation rules to flag BRICKSTORM-like behaviors (e.g., mass VM snapshot deletion, unexpected vMotion commands).

6. Step 6: Deploy the vCenter Hardening Script (Recommended)

   Mandiant’s vCenter Hardening Script automates many of the above configurations directly at the Photon Linux layer. Before running: back up the VCSA database and test in a staging environment. The script enforces:

   • Photon OS security baseline.
   • Firewall rules tailored for vCenter.
   • Service hardening (removes unnecessary daemons).
   • Audit policy settings.
   • File integrity monitoring checks.

   After execution, validate that all settings are applied using built-in compliance reports or third-party tools. Regularly re-run the script after patching or configuration changes.

7. Step 7: Perform Ongoing Security Assessments

   Continuous improvement is key. Schedule periodic vulnerability scans specific to vSphere. Penetration test the entire environment, including the management network. Review all changes against a baseline, and stay updated on BRICKSTORM indicators (IOCs) from threat intelligence sources. Periodically simulate attack scenarios to test detection and response capabilities.

Tips for Lasting Protection

• Don’t rely on defaults: vCenter and ESXi are purpose-built appliances, but they are not secure out of the box. Always customize security settings.
• Segment the management network: Isolate vCenter, ESXi management, and VM traffic to prevent lateral movement.
• Use privileged access management: Vault all administrative credentials and rotate them frequently.
• Automate where possible: Scripts and configuration management tools (Ansible, Puppet) reduce human error.
• Implement defense-in-depth: Combine network segmentation, host hardening, logging, and user education.
• Stay informed: Subscribe to security bulletins from VMware, Mandiant, and Google Threat Intelligence.
• Test backups: Ensure you can recover a VCSA from a clean backup – BRICKSTORM may attempt to destroy snapshots.

By methodically applying these steps, you can secure your virtualized environment against BRICKSTORM and similar threats. The goal is to make the virtualization layer a difficult target: closed, monitored, and resilient.