Loading malware…
BRICKSTORM is a cross-platform backdoor and remote access trojan associated with Chinese espionage activity, most prominently clusters tracked as UNC5221 and UNC6201, with reporting also linking overlapping activity to VerdantBamboo. It has been used to maintain long-term covert access on edge appliances and other systems that often lack endpoint security coverage, including VMware-related infrastructure, storage appliances, firewalls, and Windows environments. Observed victim sectors include government, legal services, technology companies, software-as-a-service providers, business process outsourcers, and IT organizations.
BRICKSTORM has been deployed following exploitation of edge-device and appliance vulnerabilities, as well as after compromise of administrative credentials. Documented intrusions show its use on Linux and BSD-based appliances such as Egnyte Storage Sync systems and pfSense firewalls, and reporting also places it in VMware hypervisor and Windows environments. Operators have used it to preserve access for extended periods, in some cases for well over a year, and to support lateral movement into internal infrastructure and cloud services such as Microsoft 365.
Functionally, BRICKSTORM provides interactive remote command execution, file and directory operations, and proxying capabilities including SOCKS and HTTP tunneling. Those proxy features have been used to route attacker traffic through victim-controlled infrastructure, blend malicious activity with legitimate SSL VPN traffic, and facilitate access to downstream environments while evading policy controls based on trusted network location. Reporting also indicates use for credential capture from compromised edge devices and for maintaining footholds that survive routine remediation efforts.
The malware’s command-and-control tradecraft includes WebSocket-based communications, TLS-protected channels, and in some variants DNS-over-HTTPS for infrastructure resolution. Base64 encoding has also been observed in its command-and-control traffic. Early variants were written in Go, while later variants have been reported in Rust, and separate BSD-compatible variants have been observed on FreeBSD-derived platforms. BRICKSTORM has appeared alongside other implants including SLAYSTYLE, PLENET, GRIMBOLT, and AGENTPSD in broader espionage operations focused on stealth, persistence, and access to enterprise and virtualized environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Most notably, CVE-2026-22769, a hardcoded credential flaw in Dell RecoverPoint for Virtual Machines, was exploited as a zero day by the PRC linked threat cluster UNC6201 since mid 2024. Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability. | Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
Another high-profile campaign involves the BRICKSTORM backdoor, linked to China-nexus actor UNC5221 and observed by Google/Mandiant, which targets VMware hypervisor and Windows environments across government and IT sector organizations.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
Mandiant (part of Google Cloud) just published a comprehensive defender’s guide on securing VMware vSphere environments against the BRICKSTORM backdoor and associated malware activity.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
Volexity found that VerdantBamboo had set up persistence for the BRICKSTORM implant by modifying the file /etc/rc.d/cron to include a single line to execute the implant.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.
the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
Volexity found that VerdantBamboo had set up persistence for the BRICKSTORM implant by modifying the file /etc/rc.d/cron to include a single line to execute the implant.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate
After this operation was successful, the threat actor removed the file from /etc/cron.d, meaning there was no long-term persistence method for this implant.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
Mandiant also released a tool for decoding Garble strings[2]... After retrieving all the matches and removing possible substrings I can emulate the code... This won’t get every single string as some are passed as offsets to the data residing in rodata section for longer pieces.
Instead of connecting to Egnyte’s own infrastructure, it was quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS, a technique that neatly disguised the malicious traffic. | The device was an Egnyte Storage Sync appliance... quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS.
Communicates with its C2 infrastructure over WebSockets, with some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
They contain three core task extensions: ... socks A Socks5 proxy server implementation
deploy additional malware to a Synology Network Attached Storage (NAS) appliance
GRIMBOLT... provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
126 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BRICKSTORM5
Backdoor delivered by UNC6201 via exploitation of Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769.
A stealthy backdoor targeting VMware hypervisor and Windows environments, enabling lateral movement, network tunnelling, and automatic reinstallation for long-term persistence in protected networks.
Tags: BRICKSTORM ... PLENET ... VerdantBamboo ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.