China Cyber Ops Turn Up the Heat: VMware, React Stacks Feeling the Burn 🔥

This is your Digital Frontline: Daily China Cyber Intel podcast. I’m Ting, and you’re on Digital Frontline: Daily China Cyber Intel, so let’s jack straight into what hit US networks in the last 24 hours. According to a joint alert from CISA, the NSA, and the Canadian Centre for Cyber Security reported by Reuters and the Times of India, China‑linked operators running the long‑term “Brickstorm” campaign have shifted from quiet persistence to data smash‑and‑grab. They’re burrowed into unnamed US and Canadian government agencies and major IT service providers, siphoning login credentials and administrative tokens, then using them to pivot across VMware vSphere and vCenter environments hosted by Broadcom’s VMware. CISA’s Madhu Gottumukkala put it bluntly: these intrusions are about positioning for “disruption and potential sabotage,” not just espionage. Homeland Security Today and Security World further attribute much of this to a China‑nexus group tracked as WARP PANDA, which has been tuning Brickstorm specifically for virtualization stacks and shared infrastructure in cloud and managed‑service environments. That means any US organization outsourcing its data centers just got dragged onto the target list: government, defense industrial base, healthcare SaaS, finance platforms, and critical manufacturing tenants all sitting on the same hypervisors. Now, add a fresh zero‑day to the mix. Tenable Research and the AWS Security Blog describe a critical remote‑code‑execution bug nicknamed React2Shell, CVE‑2025‑55182, hitting React and Next.js app stacks. Multiple US threat intel teams say China‑nexus operators were among the fastest to weaponize it against internet‑facing portals, especially in finance, e‑commerce, and logistics. Think customer portals, payment pages, and admin dashboards—if it’s Node, React, or Next.js and still unpatched, it’s basically a drive‑through window for webshells. Here’s the part where I ruin a few evenings. If you’re a US business or public agency, you should assume three things today: one, if you run VMware vSphere or vCenter and haven’t aggressively patched since early fall, Brickstorm tradecraft is relevant to you. Two, if your web teams haven’t triaged React2Shell, your marketing site may be the weakest link in your entire security program. Three, China‑linked actors are clearly synchronized with US policy shifts; outlets like the Wall Street Journal and the Atlantic Council have been pointing out that the new National Security Strategy frames China as a “near‑peer” in tech and cyber, and Beijing is acting like it. Practical moves, because Ting does not do doom without a to‑do list: immediately pull the latest Broadcom VMware advisories and apply every supported patch; enable strict logging and EDR on hypervisors and management consoles; hunt specifically for anomalous VMware API calls and unexpected admin logins over the past year. On the web side, get your security team to run a focused React2Shell scan across all R This content was created in partnership and with the help of Artificial Intelligence AI.