Loading threat actor…
BRICKSTORM is the name used for a China-linked cyber espionage activity cluster associated with the BRICKSTORM backdoor and related tooling. The activity has been attributed to PRC state-sponsored or PRC-nexus operators and has been active since at least 2022. It is characterized by unusually long dwell time, stealthy persistence, and a focus on infrastructure that often lacks conventional endpoint visibility, including VMware environments, edge appliances, and Linux-based cloud systems. The cluster has targeted organizations in government, critical infrastructure, information technology, legal services, software-as-a-service, and defense-related environments. Reported victimology includes technology companies, cloud and virtualization infrastructure, and organizations that can provide downstream access or strategic intelligence value. Operations have emphasized long-term espionage, persistent access, credential collection, and lateral movement, with concern that the access established could also support disruptive operations against infrastructure. Observed tradecraft includes use of custom malware for persistent remote control, credential extraction, SOCKS proxying, and movement across victim environments. The operators have been reported targeting VMware and Active Directory Federation Services environments and exploiting edge devices such as firewalls, VPNs, and other network appliances, including through zero-day exploitation. Their approach prioritizes defense evasion by operating on systems where EDR coverage is limited or absent, contributing to average dwell times reported at roughly 393 days. The campaign reflects a broader PRC strategic intrusion model centered on patient, low-noise access, intelligence collection, and positioning for follow-on operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked actors are exploiting edge devices like firewalls, VPNs, and network appliances using zero days and custom malware like Brickstorm.
BRICKSTORM is a malware used by China state-sponsored threat actors to target Linux-based cloud environments, enabling persistent remote system control, credential extraction, lateral movement, and evasion of detection through abuse of cloud tooling and encrypted C2 communications.
Long-dwell intrusions using the BRICKSTORM backdoor, targeting government and technology sectors, with a focus on persistence in VMware vSphere and Windows environments.
BRICKSTORM is a China-linked APT conducting long-term espionage operations targeting VMware and ADFS environments using a backdoor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.