Loading malware…
BRICKSTORM is a cross-platform backdoor and remote access trojan associated with China-nexus espionage activity, most notably clusters tracked as UNC5221 and UNC6201, with reporting also linking related activity to VerdantBamboo. It has been used to maintain long-term covert access on edge appliances and virtual infrastructure, including VMware vSphere environments, Dell RecoverPoint for Virtual Machines appliances, Egnyte Storage Sync systems, pfSense firewalls, and Windows systems. Multiple investigations describe dwell times exceeding a year, reflecting its role as a persistence and post-compromise access tool in strategic intrusions targeting government, legal, technology, IT, and managed service provider environments.
BRICKSTORM has been described as a Golang-based RAT in earlier variants, with later variants reportedly rewritten in Rust. FreeBSD and BSD-compatible variants have also been observed, underscoring deliberate adaptation for appliance and hypervisor-adjacent environments that often lack endpoint security coverage. The malware supports interactive shell access, remote command execution, file and directory operations, and proxying capabilities including SOCKS4/5 and HTTP proxying. Operators have used these proxy features to route traffic through victim infrastructure, blend with legitimate SSL VPN activity, and access cloud services such as Microsoft 365 while evading IP-based trust controls and conditional access policies.
Command and control communications have been observed over encrypted channels including TLS and WebSockets, with some variants using DNS-over-HTTPS for lookups. Base64 encoding has also been used to obfuscate C2 traffic. In victim environments, BRICKSTORM has functioned as a foothold for broader espionage operations, enabling credential capture, lateral movement, persistence, and follow-on deployment of additional tooling such as SLAYSTYLE, PLENET, GRIMBOLT, and AGENTPSD. Reporting also links BRICKSTORM-enabled intrusions to theft of virtual machine snapshots and other credential-access activity in VMware environments.
Operationally, BRICKSTORM is notable for targeting proprietary and edge systems that defenders often monitor poorly, such as firewalls, storage appliances, VPN-facing devices, and hypervisor infrastructure. Threat actors have used it after exploiting zero-day vulnerabilities, abusing valid credentials, and escalating privileges on compromised appliances. It has also been used in campaigns involving hidden rogue virtual machines, stealthy pivoting inside VMware estates, and long-term access to sensitive enterprise environments. Its repeated use across PRC-linked espionage campaigns indicates that BRICKSTORM is a mature persistence and remote-access platform optimized for stealthy operations on nontraditional enterprise endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Most notably, CVE-2026-22769, a hardcoded credential flaw in Dell RecoverPoint for Virtual Machines, was exploited as a zero day by the PRC linked threat cluster UNC6201 since mid 2024. Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability. | Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Podľa portálu Bloomberg systémy F5 kompromitovala čínska štátom sponzorovaná skupina UNC5221 malvérom BrickStorm a zotrvala v sieti vyše 12 mesiacov. Na aktivity tejto skupiny súvisiace so šírením BrickStorm koncom septembra 2025 upozornila GTIG.
Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
Mandiant (part of Google Cloud) just published a comprehensive defender’s guide on securing VMware vSphere environments against the BRICKSTORM backdoor and associated malware activity.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
Volexity found that VerdantBamboo had set up persistence for the BRICKSTORM implant by modifying the file /etc/rc.d/cron to include a single line to execute the implant.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.
the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
Volexity found that VerdantBamboo had set up persistence for the BRICKSTORM implant by modifying the file /etc/rc.d/cron to include a single line to execute the implant.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate
Instead of connecting to Egnyte’s own infrastructure, it was quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS, a technique that neatly disguised the malicious traffic. | The device was an Egnyte Storage Sync appliance... quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS.
Communicates with its C2 infrastructure over WebSockets, with some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
They contain three core task extensions: ... socks A Socks5 proxy server implementation
deploy additional malware to a Synology Network Attached Storage (NAS) appliance
GRIMBOLT... provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
128 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware deployed on compromised VMware vSphere servers by Chinese threat actors; associated in the article with post-compromise activity including rogue VM creation and theft of cloned VM snapshots for credential theft.
BRICKSTORM5
Backdoor delivered by UNC6201 via exploitation of Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769.
A stealthy backdoor targeting VMware hypervisor and Windows environments, enabling lateral movement, network tunnelling, and automatic reinstallation for long-term persistence in protected networks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.