Junction

Junction is a previously undocumented Golang-based implant used in VMware ESXi environments. CrowdStrike reported it being deployed on ESXi hosts alongside the BRICKSTORM malware family and the related GuestConduit implant, which runs in guest VMs. The malware has been attributed in reporting to the China-nexus threat actor WARP PANDA, and its use has been observed in intrusions targeting VMware vCenter environments at U.S.-based legal, technology, and manufacturing organizations. Reported intrusion chains commonly involved exploitation of internet-facing edge devices, pivoting into vCenter with valid credentials or vCenter vulnerability exploitation, and lateral movement using SSH and the privileged vCenter account vpxuser. High-confidence functionality described for Junction includes acting as an HTTP server, executing commands, proxying traffic, and interacting with guest VMs via VSOCK. It has been reported to masquerade as a legitimate ESXi service by listening on port 8090, a port associated in the reporting with VMware vvold. Junction appears designed to support covert communication within virtualized environments and to facilitate tunneling between ESXi hosts and guest VMs in conjunction with GuestConduit, which establishes a VSOCK listener on port 5555. Its deployment has been reported as part of stealth-focused, long-term persistence operations in VMware ecosystems.