Brickstorm

BRICKSTORM is the name used for a China-linked cyber espionage activity cluster associated with the BRICKSTORM backdoor and related tooling. The activity has been attributed to PRC state-sponsored or PRC-nexus operators and has been active since at least 2022. It is characterized by unusually long dwell time, stealthy persistence, and a focus on infrastructure that often lacks conventional endpoint visibility, including VMware environments, edge appliances, and Linux-based cloud systems. The cluster has targeted organizations in government, critical infrastructure, information technology, legal services, software-as-a-service, and defense-related environments. Reported victimology includes technology companies, cloud and virtualization infrastructure, and organizations that can provide downstream access or strategic intelligence value. Operations have emphasized long-term espionage, persistent access, credential collection, and lateral movement, with concern that the access established could also support disruptive operations against infrastructure. Observed tradecraft includes use of custom malware for persistent remote control, credential extraction, SOCKS proxying, and movement across victim environments. The operators have been reported targeting VMware and Active Directory Federation Services environments and exploiting edge devices such as firewalls, VPNs, and other network appliances, including through zero-day exploitation. Their approach prioritizes defense evasion by operating on systems where EDR coverage is limited or absent, contributing to average dwell times reported at roughly 393 days. The campaign reflects a broader PRC strategic intrusion model centered on patient, low-noise access, intelligence collection, and positioning for follow-on operations.