prc_state_sponsored_cyber_actors
People’s Republic of China (PRC) state-sponsored cyber actors attributed by CISA, NSA, and the Canadian Centre for Cyber Security to the BRICKSTORM malware activity. The activity targets primarily Government Services and Facilities and the Information Technology sector, with a strong focus on VMware vSphere environments (VMware vCenter servers and VMware ESXi platforms) as well as Windows environments. The actors have been observed maintaining long-term persistent access (noted in one case from at least April 2024 through September 2025), including deployment of BRICKSTORM to an internal VMware vCenter server and subsequent compromise of two domain controllers and an ADFS server, with export/theft of cryptographic keys and theft of Active Directory databases/credentials. Tactics, techniques, and procedures described include initial access via web shells on DMZ servers, followed by lateral movement using stolen credentials and RDP/SMB. BRICKSTORM is described as a custom-built ELF backdoor implemented in Go and Rust (multiple variants analyzed), providing comprehensive system control including interactive shell access, remote command execution, file upload/download and manipulation, directory listing, and in some variants SOCKS proxy functionality to facilitate lateral movement. Command-and-control is characterized by multiple layers of encryption and traffic blending/masquerading, including HTTPS, WebSockets, nested TLS, and DNS-over-HTTPS (including use of public DoH resolvers such as Cloudflare, Google, and Quad9), and the malware may mimic legitimate web server functionality. Persistence mechanisms described include self-watching/automatic reinstallation, modification of system init files, and PATH environment variable manipulation, including masquerading as legitimate VMware binaries; some variants leverage VSOCK interfaces for inter-VM communication and persistence in virtualized environments. Privilege escalation is noted via use of sudo on compromised systems.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Associated vulnerabilities
18 CVEs this actor has used in observed campaigns. 18 of them exploited in the wild.
Table 1 lists CVE-2017-6862 among the top network device CVEs most frequently exploited by PRC state-sponsored cyber actors since 2020. Table 10 describes authentication bypass and remote code execution in NETGEAR WNR2000 devices.
NSA, CISA, and the FBI consider the common vulnerabilities and exposures (CVEs) listed in Table 1 to be the network device CVEs most frequently exploited by PRC state-sponsored cyber actors since 2020. Table 2 describes Cisco CVE-2018-0171 in the Smart Install feature of Cisco IOS and IOS XE Software.
Table 1 lists CVE-2018-13382 among the top network device CVEs most frequently exploited by PRC state-sponsored cyber actors since 2020. Table 8 describes it as an improper authorization vulnerability in Fortinet FortiOS and FortiProxy SSL VPN web portal.
Table 1 lists CVE-2018-14847 among the top network device CVEs most frequently exploited by PRC state-sponsored cyber actors since 2020. Table 9 describes it as a directory traversal vulnerability in the WinBox interface of MikroTik RouterOS.
Table 1 lists CVE-2019-11510 among the top network device CVEs most frequently exploited by PRC state-sponsored cyber actors since 2020. Table 11 describes it as an arbitrary file read vulnerability in Pulse Secure Pulse Connect Secure.
13 more CVEs tied to this actor tracked in Mallory.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting long-term cyber espionage and persistent access operations against government and IT sector organizations using custom malware (BRICKSTORM), with a focus on VMware vSphere environments.
Conducting long-term espionage and intelligence-collection campaigns targeting government, information technology, legal, SaaS, and technology sectors using the BRICKSTORM malware. The campaigns focus on maintaining persistent, covert access to victim networks, stealing intellectual property, sensitive data, and targeting email inboxes of senior leaders and individuals aligned with PRC economic and espionage interests.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.