Loading malware…
BRICKSTORM is a cross-platform espionage backdoor and remote access trojan associated primarily with the China-nexus threat cluster UNC5221, also tracked by some researchers as VerdantBamboo, and has also been observed in activity attributed to UNC6201. It has been used in long-dwell intrusions against virtualization infrastructure, edge appliances, enterprise storage systems, firewalls, and Windows hosts, including campaigns affecting government, legal, technology, IT, and other strategically significant sectors.
Early publicly documented variants were written in Go and targeted Linux-based VMware vCenter and vSphere environments, while later reporting identified Windows variants and FreeBSD-compatible builds used on appliances such as pfSense. Some reporting also notes newer Rust-based variants. BRICKSTORM has been deployed on systems that often lack robust endpoint monitoring, including VPN appliances, storage synchronization appliances, firewalls, and hypervisor management infrastructure, enabling operators to maintain covert persistence for extended periods.
Its functionality includes remote access, file and directory management, interactive shell or command execution in some variants, web server functionality, and network tunneling or proxying. Documented capabilities include SOCKS and HTTP proxying, TCP, UDP, and ICMP relaying, and use as an internal pivot point to reach additional systems and cloud services. Windows variants exposed a JSON-based file-management interface and supported tunneling, while some operators paired the tunneling capability with valid credentials to access services such as RDP and SMB rather than relying solely on direct command execution.
BRICKSTORM uses encrypted command-and-control communications, including TLS and WebSocket-based channels, and some variants resolve infrastructure through DNS over HTTPS. Base64 encoding has also been observed in its communications. Reporting describes layered communications designs that can include HTTPS upgraded to WebSocket and nested TLS sessions, with session multiplexing to support multiple concurrent channels. Public cloud and cloud-fronted infrastructure have been used to help conceal command-and-control activity.
Persistence mechanisms vary by platform and intrusion set. Observed methods include scheduled tasks on Windows, startup-script or service modifications on Linux and BSD systems, and cron-based or boot-time execution on appliance platforms. In VMware-focused intrusions, BRICKSTORM was used after exploitation of edge-device and appliance vulnerabilities and supported long-term access, lateral movement, and data theft. In appliance-centric campaigns, it was used as a covert proxy to route attacker traffic through victim infrastructure, including to access Microsoft 365 environments in ways intended to blend with trusted network paths and evade policy controls.
BRICKSTORM has been linked to exploitation chains involving Ivanti Connect Secure, VMware infrastructure, Egnyte Storage Sync, Dell RecoverPoint for Virtual Machines, and other edge or management systems. It has figured prominently in Chinese cyber-espionage operations characterized by long dwell time, stealthy persistence, credential abuse, and post-compromise pivoting across enterprise and cloud environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Most notably, CVE-2026-22769, a hardcoded credential flaw in Dell RecoverPoint for Virtual Machines, was exploited as a zero day by the PRC linked threat cluster UNC6201 since mid 2024. Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability. | Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This report delivers a comprehensive technical analysis of BRICKSTORM, an espionage backdoor linked to the China-nexus cluster UNC5221.
Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
Mandiant (part of Google Cloud) just published a comprehensive defender’s guide on securing VMware vSphere environments against the BRICKSTORM backdoor and associated malware activity.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers may leverage network tunneling to, for example, relay RDP and SMB connections... attackers have been observed deploying BRICKSTORM on domain-joined devices after having obtained valid privileged credentials.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The adversaries relied on persistence mechanisms such as scheduled tasks for execution.
Attackers may leverage network tunneling to, for example, relay RDP and SMB connections... attackers have been observed deploying BRICKSTORM on domain-joined devices after having obtained valid privileged credentials.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
Both versions were given local persistence mechanisms. /mnt/cpt/tmpd was given both /etc/rc.local and /etc/init.d/urandom_seed while /bin/httpd was given /etc/init.d/urandom_seed persistence method.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The adversaries relied on persistence mechanisms such as scheduled tasks for execution.
PRC-attributed intrusions increasingly involve the usage of previously unknown vulnerabilities (a.k.a., zero-days) alongside low-noise backdoors such as the hereafter documented BRICKSTORM family.
Attackers may leverage network tunneling to, for example, relay RDP and SMB connections... attackers have been observed deploying BRICKSTORM on domain-joined devices after having obtained valid privileged credentials.
Both versions were given local persistence mechanisms. /mnt/cpt/tmpd was given both /etc/rc.local and /etc/init.d/urandom_seed while /bin/httpd was given /etc/init.d/urandom_seed persistence method.
The BRICKSTORM family resolves its Command & Control servers through DoH (DNS over HTTPS), hindering most network monitoring solutions. | Once BRICKSTORM has the front service IPs ... the backdoor connects to the Command & Control domain over HTTPS ... The backdoor then upgrades the HTTPS connection to a WebSocket.
Communicates with its C2 infrastructure over WebSockets, with some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
Similarly, BRICKSTORM resolves its Command & Control domains through public DoH (DNS over HTTPS) providers which encapsulates plaintext DNS messages within secure HTTPS connections.
Observed BRICKSTORM Command & Control infrastructure leverages public cloud services as a front; Abused solutions include Cloudflare Workers as well as Heroku applications.
The backdoor’s JSON-based API provides a wide range of file-related actions such as uploading, downloading, renaming, and deleting files.
57 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
131 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware deployed on compromised VMware vSphere servers by Chinese threat actors; associated in the article with post-compromise activity including rogue VM creation and theft of cloned VM snapshots for credential theft.
BRICKSTORM5
Backdoor delivered by UNC6201 via exploitation of Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769.
A stealthy backdoor targeting VMware hypervisor and Windows environments, enabling lateral movement, network tunnelling, and automatic reinstallation for long-term persistence in protected networks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.