CISA Releases Updated IOCs and Detection Guidance for BRICKSTORM Malware

People’s Republic of China (PRC) state-sponsored cyber actors have been observed deploying the sophisticated BRICKSTORM backdoor malware to maintain long-term, stealthy access within government and information technology sector networks. BRICKSTORM targets both VMware vSphere and Windows environments, employing advanced evasion techniques such as multiple layers of encryption, DNS-over-HTTPS, and a SOCKS proxy for lateral movement. The malware is designed for persistence, with self-monitoring features that allow it to automatically reinstall or restart if disrupted, and has been linked to intrusions where attackers leveraged legitimate credentials and exfiltrated sensitive data from compromised systems. CISA, NSA, and the Canadian Centre for Cyber Security have jointly released detailed analysis and detection guidance for BRICKSTORM, including indicators of compromise (IOCs), YARA and Sigma rules, and technical breakdowns of eight malware samples. Organizations in government and critical infrastructure sectors are urged to use these resources to detect and respond to BRICKSTORM infections, and to report any related activity to authorities. The campaign highlights the evolving capabilities of PRC state-sponsored actors and the need for robust monitoring and incident response in targeted sectors.

Dec 4, 2025

UNC5221 Cyberespionage Campaign Using BRICKSTORM Backdoor Against U.S. Legal and Technology Sectors

Suspected China-linked threat group UNC5221 has infiltrated numerous U.S. organizations in the legal, technology, SaaS, and business process outsourcing sectors using the BRICKSTORM backdoor. The campaign, uncovered by Google Threat Intelligence and Mandiant, has enabled persistent access for over a year, with attackers remaining undetected for an average of 393 days. BRICKSTORM, a Go-based malware, provides extensive capabilities including web server setup, file manipulation, command execution, and acting as a SOCKS relay, and is often deployed on appliances lacking endpoint detection and response (EDR) support. The attackers have leveraged these intrusions to steal intellectual property, gather intelligence on national security and trade, and potentially develop new zero-day exploits, with evidence suggesting exploitation of edge device vulnerabilities such as those in Ivanti products. The campaign's stealth and focus on high-value targets raise concerns about long-term impacts and the potential for further downstream compromises.

Feb 1, 2026

Chinese APT UNC5221 Deploys 'Brickstorm' Backdoor on Edge Devices for Long-Term Espionage

A China-linked cyber-espionage group, tracked as UNC5221, has been systematically targeting network and infrastructure appliances that lack traditional endpoint detection and response (EDR) capabilities. The group has deployed a sophisticated backdoor, known as 'Brickstorm,' to enable persistent, long-term access to compromised environments. According to Google’s Threat Intelligence Group (GTIG), the campaign has affected organizations across various sectors, including legal services, technology, software-as-a-service (SaaS) providers, and business process outsourcing. The attackers have exploited the lack of EDR support on edge devices, making detection and remediation particularly challenging. Brickstorm is designed to evade detection by mimicking legitimate software and using unique command-and-control (C2) servers for each victim, which complicates efforts to block or track the malware. The average dwell time for the attackers within victim networks has been reported as 393 days, indicating a high level of stealth and operational security. During this time, UNC5221 has been observed accessing sensitive emails belonging to developers, administrators, and other individuals of strategic interest, often by abusing Microsoft Entra ID enterprise applications with elevated permissions. The campaign has also resulted in the compromise of SaaS providers, which in turn has led to downstream access to their customers’ environments, amplifying the potential impact. The attackers have targeted leading network appliances from vendors such as SonicWall, Cisco, and Palo Alto Networks, highlighting the breadth of the campaign. GTIG reports that the threat actors have used their access to steal proprietary source code and other intellectual property related to enterprise technologies, which may be analyzed to discover new vulnerabilities for future exploitation. The campaign’s focus on long-term, undetected access distinguishes it from other Chinese-linked espionage operations, such as RedNovember, which prioritizes speed and scale over stealth. Security experts note that the strategic aim of these campaigns is to gain intelligence and maintain persistent access to high-value targets globally. The use of unique C2 infrastructure for each victim further complicates incident response and attribution. The campaign’s ability to remain undetected for over a year in some environments underscores the need for improved monitoring and security controls on edge devices and network appliances. The targeting of organizations with access to downstream customers raises concerns about supply chain risks and the potential for widespread secondary compromise. Researchers emphasize that the attackers’ analysis of stolen source code could lead to the discovery of zero-day vulnerabilities, increasing the threat to enterprise technology products worldwide. The campaign demonstrates the evolving tactics of Chinese APT groups in targeting critical infrastructure and enterprise technologies. Organizations are urged to review their security posture, particularly regarding edge devices and third-party service providers, to mitigate the risk of similar intrusions. The incident highlights the importance of cross-sector collaboration and intelligence sharing to detect and respond to sophisticated, long-term cyber-espionage campaigns.

Sep 24, 2025

CISA Releases Updated IOCs and Detection Guidance for BRICKSTORM Malware

How this story unfolded

Two new YARA rules and analysis of 11 BRICKSTORM variants published

CISA and partners update BRICKSTORM malware analysis report

Related entities

Malware

Affected products

Sources

See the full picture, correlated to your attack surface.

CISA Releases Updated IOCs and Detection Guidance for BRICKSTORM Malware

How this story unfolded

Two new YARA rules and analysis of 11 BRICKSTORM variants published

CISA and partners update BRICKSTORM malware analysis report

Related entities

Malware

Affected products

Sources

See the full picture, correlated to your attack surface.

CISA Releases Updated IOCs and Detection Guidance for BRICKSTORM Malware

How this story unfolded

Two new YARA rules and analysis of 11 BRICKSTORM variants published

CISA and partners update BRICKSTORM malware analysis report

Related entities

Malware

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

PRC State-Sponsored Use of BRICKSTORM Malware for Persistent Access

UNC5221 Cyberespionage Campaign Using BRICKSTORM Backdoor Against U.S. Legal and Technology Sectors

Chinese APT UNC5221 Deploys 'Brickstorm' Backdoor on Edge Devices for Long-Term Espionage

CISA Releases Updated IOCs and Detection Guidance for BRICKSTORM Malware

How this story unfolded

Two new YARA rules and analysis of 11 BRICKSTORM variants published

CISA and partners update BRICKSTORM malware analysis report

Related entities

Malware

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

PRC State-Sponsored Use of BRICKSTORM Malware for Persistent Access

UNC5221 Cyberespionage Campaign Using BRICKSTORM Backdoor Against U.S. Legal and Technology Sectors

Chinese APT UNC5221 Deploys 'Brickstorm' Backdoor on Edge Devices for Long-Term Espionage