Endpoint detection at APAC financial institutions was tuned to UNC3886's documented Windows tradecraft. The Linux variant of BRICKSTORM, confirmed active this week by security researchers, runs on VMware ESXi hypervisors, infrastructure where the endpoint sensors built against Mandiant's prior UNC3886 reporting have no coverage. UNC3886, the China-nexus intrusion group with a documented pattern targeting defense contractors and telecommunications providers, has extended this persistence implant from guest operating systems into the hypervisor layer, using the same HTTPS command-and-control protocol as prior Windows deployments. The network artifact is identical. The host artifact is absent.

Neither HKMA's Cybersecurity Fortification Initiative 2.0 nor MAS Technology Risk Management 2021 prescribes detection instrumentation at the bare-metal hypervisor tier; both frameworks address logical separation between environments without specifying what monitors the separation boundary itself. The detection gap is not a misconfiguration. It is a framework gap. From the ESXi layer, an operator running BRICKSTORM can observe guest virtual machines, including the trading systems, core banking middleware, and treasury platforms sitting above them, without generating a host-level alert in any deployed endpoint detection product. The question HKMA's Cyber Resilience Assessment, scheduled to open its Q3 2026 inspection cycle, should be directing at institutions is whether hypervisor-layer telemetry has been activated, not whether it has been purchased.