Loading story…
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the Canadian Centre for Cyber Security, has released an updated advisory on the BRICKSTORM backdoor malware. The update includes new indicators of compromise (IOCs), detection signatures, and analysis of three additional malware samples, bringing the total to 11 analyzed variants. Notably, the latest samples include Rust-based variants, highlighting the evolving tactics of the People’s Republic of China (PRC) state-sponsored actors behind BRICKSTORM. The malware is known for targeting government and IT sectors, particularly VMware vSphere environments, and employs advanced persistence, encryption, and defense evasion techniques.
The advisory provides new YARA rules and detection guidance to help organizations identify and respond to BRICKSTORM infections. The malware leverages multiple layers of encryption, such as HTTPS, WebSockets, and DNS-over-HTTPS, to conceal its command-and-control communications and blends malicious activity with legitimate network traffic. Organizations are urged to deploy the updated IOCs and signatures, scan for BRICKSTORM-related activity, and report any detections to CISA for further investigation and response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The updated advisory published technical details on 11 BRICKSTORM variants and introduced two new YARA detection signatures to help defenders identify infections. Agencies urged organizations, particularly those operating VMware vSphere environments in government and IT sectors, to apply the new detection guidance and report related incidents.
CISA, NSA, and the Canadian Centre for Cyber Security released an updated Malware Analysis Report on the BRICKSTORM backdoor, adding new indicators of compromise and detection signatures. The update covered additional samples, including Rust-based variants with persistence, defense evasion, and encrypted WebSocket command-and-control capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
People’s Republic of China (PRC) state-sponsored cyber actors have been observed deploying the sophisticated BRICKSTORM backdoor malware to maintain long-term, stealthy access within government and information technology sector networks. BRICKSTORM targets both VMware vSphere and Windows environments, employing advanced evasion techniques such as multiple layers of encryption, DNS-over-HTTPS, and a SOCKS proxy for lateral movement. The malware is designed for persistence, with self-monitoring features that allow it to automatically reinstall or restart if disrupted, and has been linked to intrusions where attackers leveraged legitimate credentials and exfiltrated sensitive data from compromised systems. CISA, NSA, and the Canadian Centre for Cyber Security have jointly released detailed analysis and detection guidance for BRICKSTORM, including indicators of compromise (IOCs), YARA and Sigma rules, and technical breakdowns of eight malware samples. Organizations in government and critical infrastructure sectors are urged to use these resources to detect and respond to BRICKSTORM infections, and to report any related activity to authorities. The campaign highlights the evolving capabilities of PRC state-sponsored actors and the need for robust monitoring and incident response in targeted sectors.
Jun 29, 2026
CISA published malware analysis reports covering multiple state-linked implants, including the North Korean **COPPERHEDGE** and **BLINDINGCAN** remote access tools and the **SUNBURST** backdoor tied to the SolarWinds compromise. The reports describe how these malware families were used to establish persistence, conduct reconnaissance, execute arbitrary commands, and exfiltrate data from victim environments, with COPPERHEDGE specifically attributed with high confidence to North Korean **HIDDEN COBRA** actors and linked to campaigns targeting cryptocurrency exchanges and related entities. The technical reporting highlights distinct malware variants, command-and-control patterns, and detection opportunities for defenders. For COPPERHEDGE, CISA documented six variants across Windows DLL samples, noting differences in HTTP beaconing, encryption, and POST formatting, including use of **RC4**, **Base64**, XOR-based encoding, and Google Analytics-like cookies, alongside dozens of associated domains and sample hashes. Across the reports, CISA provided indicators, malware characteristics, and detection guidance such as **YARA** and **Snort** signatures to help organizations identify related activity and prioritize mitigation and reporting.
Jun 29, 2026
F5 disclosed that a state-sponsored intruder maintained long-term access to its environment and stole sensitive data including **BIG-IP source code**, details of reported but not yet patched or disclosed vulnerabilities, and configuration and implementation information for a limited number of customers. Reporting attributed the intrusion to the China-linked group **UNC5221**, which allegedly used the **BRICKSTORM** backdoor and remained in the environment for more than 12 months. F5 said the incident did **not** involve a supply-chain compromise and did not affect CRM, financial systems, customer support, iHealth, or systems tied to other product lines. Mandiant separately published hunting guidance describing BRICKSTORM as a stealthy espionage backdoor deployed on edge devices and appliances, with operators pivoting into enterprise environments through suspicious outbound traffic, appliance management interfaces, Windows **Type 3** logons, occasional **RDP**, Microsoft 365 mail access abuse, and VMware vCenter or ESXi account manipulation. Defenders were urged to scan appliance files and backups with **YARA** and a Linux/BSD appliance scanner, review logs for rare **DNS-over-HTTPS** activity, inspect Windows User Access Logs, and check vCenter audit trails for temporary local accounts used to install BRICKSTORM. F5 said it rotated cryptographic material and released updates for **BIG-IP**, **F5OS**, **BIG-IP Next for Kubernetes**, **BIG-IQ**, and **APM clients** to address 44 vulnerabilities, including the leaked issues.
Jul 24, 2026