Loading story…
People’s Republic of China (PRC) state-sponsored cyber actors have been observed deploying the sophisticated BRICKSTORM backdoor malware to maintain long-term, stealthy access within government and information technology sector networks. BRICKSTORM targets both VMware vSphere and Windows environments, employing advanced evasion techniques such as multiple layers of encryption, DNS-over-HTTPS, and a SOCKS proxy for lateral movement. The malware is designed for persistence, with self-monitoring features that allow it to automatically reinstall or restart if disrupted, and has been linked to intrusions where attackers leveraged legitimate credentials and exfiltrated sensitive data from compromised systems.
CISA, NSA, and the Canadian Centre for Cyber Security have jointly released detailed analysis and detection guidance for BRICKSTORM, including indicators of compromise (IOCs), YARA and Sigma rules, and technical breakdowns of eight malware samples. Organizations in government and critical infrastructure sectors are urged to use these resources to detect and respond to BRICKSTORM infections, and to report any related activity to authorities. The campaign highlights the evolving capabilities of PRC state-sponsored actors and the need for robust monitoring and incident response in targeted sectors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Following the joint advisory, multiple reports said private-sector researchers linked related BRICKSTORM activity to China-nexus clusters including UNC5221 and WARP PANDA. The reporting connected the malware to broader espionage operations involving edge-device exploitation, cloud abuse, and long-term persistence.
On December 4, 2025, CISA, NSA, and the Canadian Centre for Cyber Security published a joint warning and malware analysis report on BRICKSTORM. The release included analysis of eight samples and variants, indicators of compromise, YARA and Sigma rules, and mitigation guidance for affected sectors.
CISA's malware analysis said the implant maintained access in victim environments from at least April 2024 through September 2025. This indicates the campaign remained active and undetected in some networks for well over a year.
Mandiant reported responding to numerous BRICKSTORM intrusions since March 2025 across legal, SaaS, and technology organizations. It said the operations sought intellectual property and sensitive data, including senior leaders' email inboxes.
CrowdStrike attributed 2025 BRICKSTORM intrusions against U.S. legal, technology, and manufacturing firms to a China-nexus group it calls WARP PANDA. The company assessed the activity as likely supporting PRC intelligence collection.
During the investigated intrusion, the actors later compromised domain controllers and an ADFS server after establishing access in VMware infrastructure. They exported cryptographic keys and harvested Active Directory data to deepen persistence and access.
CISA and partner reporting said BRICKSTORM activity was observed from at least April 2024 through September 2025, affecting government, IT, legal, SaaS, technology, and other sectors. The malware enabled long-term persistence, credential theft, lateral movement, and data access in VMware and Windows environments.
In one confirmed incident, PRC state-sponsored actors first compromised a DMZ web server in April 2024 and then moved laterally to an internal VMware vCenter server, where they deployed BRICKSTORM. This marked the start of a long-term intrusion used to maintain stealthy access.
CrowdStrike said the China-nexus group it tracks as WARP PANDA has targeted U.S. organizations since at least late 2023, focusing on VMware vCenter and cloud environments. The activity included use of the BRICKSTORM malware family and related implants for covert persistence and data theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
austinlarsen.me
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcecsoonline.com
Open sourcecyberscoop.com
Open sourcebankinfosecurity.com
Open sourcedarkreading.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the Canadian Centre for Cyber Security, has released an updated advisory on the BRICKSTORM backdoor malware. The update includes new indicators of compromise (IOCs), detection signatures, and analysis of three additional malware samples, bringing the total to 11 analyzed variants. Notably, the latest samples include Rust-based variants, highlighting the evolving tactics of the People’s Republic of China (PRC) state-sponsored actors behind BRICKSTORM. The malware is known for targeting government and IT sectors, particularly VMware vSphere environments, and employs advanced persistence, encryption, and defense evasion techniques. The advisory provides new YARA rules and detection guidance to help organizations identify and respond to BRICKSTORM infections. The malware leverages multiple layers of encryption, such as HTTPS, WebSockets, and DNS-over-HTTPS, to conceal its command-and-control communications and blends malicious activity with legitimate network traffic. Organizations are urged to deploy the updated IOCs and signatures, scan for BRICKSTORM-related activity, and report any detections to CISA for further investigation and response.
Jun 29, 2026
F5 disclosed that a state-sponsored intruder maintained long-term access to its environment and stole sensitive data including **BIG-IP source code**, details of reported but not yet patched or disclosed vulnerabilities, and configuration and implementation information for a limited number of customers. Reporting attributed the intrusion to the China-linked group **UNC5221**, which allegedly used the **BRICKSTORM** backdoor and remained in the environment for more than 12 months. F5 said the incident did **not** involve a supply-chain compromise and did not affect CRM, financial systems, customer support, iHealth, or systems tied to other product lines. Mandiant separately published hunting guidance describing BRICKSTORM as a stealthy espionage backdoor deployed on edge devices and appliances, with operators pivoting into enterprise environments through suspicious outbound traffic, appliance management interfaces, Windows **Type 3** logons, occasional **RDP**, Microsoft 365 mail access abuse, and VMware vCenter or ESXi account manipulation. Defenders were urged to scan appliance files and backups with **YARA** and a Linux/BSD appliance scanner, review logs for rare **DNS-over-HTTPS** activity, inspect Windows User Access Logs, and check vCenter audit trails for temporary local accounts used to install BRICKSTORM. F5 said it rotated cryptographic material and released updates for **BIG-IP**, **F5OS**, **BIG-IP Next for Kubernetes**, **BIG-IQ**, and **APM clients** to address 44 vulnerabilities, including the leaked issues.
Jul 24, 2026
Volexity reported that the China-linked threat actor **VerdantBamboo**—also tracked as **WARP PANDA** and `UNC5221`—compromised an organization through its managed services provider and maintained access for at least 18 months by abusing edge infrastructure and proprietary appliances. Investigators found the actor on an **Egnyte Storage Sync** appliance, where it deployed **BRICKSTORM** as its primary implant and used **AGENTPSD** as a fallback reverse shell, then pivoted with stolen credentials and SSL VPN access to reach internal systems and **Microsoft 365** while bypassing Conditional Access protections. The intrusion also affected the victim’s MSP, where Volexity found a **pfSense** firewall running a FreeBSD variant of **BRICKSTORM** and assessed with medium confidence that the MSP breach was the likely initial access path. During the investigation, Volexity identified a local privilege escalation issue tied to `sudo` permissions for Egnyte’s default `egnyteservice` account, later fixed in **Storage Sync v13.13**, and documented a new **.NET Native AOT** backdoor named **PLENET** on a **Synology NAS**. The findings indicate VerdantBamboo deliberately targets appliances and firewall-adjacent systems that often lack EDR coverage, using them as covert proxies and long-term persistence points.
Jun 29, 2026