Brickstorm
BRICKSTORM is a backdoor/malware family used by PRC-nexus (China-linked) state-sponsored threat actors in long-running cyber-espionage operations. Reporting from Google Threat Intelligence Group and joint advisories from NSA, CISA, and the Canadian Centre for Cyber Security describe BRICKSTORM as being used to maintain persistent remote control in victim environments with an average dwell time of ~393 days, affecting dozens of organizations since at least 2022. Observed targeting includes government services, critical infrastructure, IT, technology sector organizations, and U.S. defense contractors. The activity has been associated with compromises of edge/perimeter devices (e.g., firewalls/VPNs/network appliances) and subsequent presence in Linux-based cloud environments, as well as VMware vSphere and Windows environments; advisories also note targeting of ADFS. Described capabilities include persistence, credential extraction, lateral movement, and evasion (including use of cloud tooling and encryption). Public reporting cautions the operators appear positioned not only for espionage against U.S. infrastructure but also potentially disruptive cyberattacks. Initial access vectors are not specified in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked actors are exploiting edge devices like firewalls, VPNs, and network appliances using zero days and custom malware like Brickstorm.
BRICKSTORM is a malware used by China state-sponsored threat actors to target Linux-based cloud environments, enabling persistent remote system control, credential extraction, lateral movement, and evasion of detection through abuse of cloud tooling and encrypted C2 communications.
Long-dwell intrusions using the BRICKSTORM backdoor, targeting government and technology sectors, with a focus on persistence in VMware vSphere and Windows environments.
BRICKSTORM is a China-linked APT conducting long-term espionage operations targeting VMware and ADFS environments using a backdoor.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.