Loading malware…
BRICKSTORM is a cross-platform backdoor and remote access trojan associated primarily with China-linked espionage activity, especially operations attributed to UNC5221 and UNC6201, with reporting also linking overlapping activity to VerdantBamboo. It has been used to maintain long-term covert access in enterprise and government environments, including campaigns targeting edge appliances, VMware infrastructure, storage appliances, firewalls, and Windows systems. Observed victim sectors include government, legal services, technology, IT, and managed service provider environments.
The malware has been deployed after exploitation of edge-device and appliance vulnerabilities as well as through abuse of valid credentials on poorly monitored systems. Documented intrusion chains include compromises of products such as Egnyte Storage Sync, pfSense firewalls, VMware-related environments, Dell RecoverPoint for Virtual Machines, and F5 infrastructure. Operators have used BRICKSTORM to persist on systems that often lack endpoint security coverage, enabling dwell times measured in many months and in some cases more than a year.
BRICKSTORM provides core remote-access functionality including interactive shell command execution, file and directory operations, and proxying capabilities. Reported variants support SOCKS4/5 and HTTP proxying, allowing operators to route traffic through victim infrastructure, blend with legitimate network paths, and pivot into internal services and cloud environments such as Microsoft 365. This proxying capability has been used to make attacker activity appear to originate from trusted enterprise infrastructure and to evade IP-based access controls. In broader campaigns tied to the same operators, BRICKSTORM has supported credential capture from compromised appliances and has been used as a foothold for lateral movement and follow-on malware deployment.
The malware’s command-and-control tradecraft emphasizes stealth and resilience. Public reporting describes communications over TLS and WebSockets, with some variants using DNS-over-HTTPS for infrastructure lookups and Base64-encoded C2 data. Early samples were described as Golang-based, while later variants have been reported in Rust; FreeBSD/BSD-compatible variants have also been observed, underscoring active development and portability across Unix-like platforms.
Persistence has been achieved through modification of native startup and scheduling mechanisms on appliance and firewall platforms, and BRICKSTORM has repeatedly appeared alongside related tooling such as SLAYSTYLE, PLENET, GRIMBOLT, and AGENTPSD. Its repeated use in long-duration espionage intrusions, especially against edge systems and virtualization-adjacent infrastructure, makes it notable as a purpose-built implant for covert access, internal proxying, and sustained post-compromise operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Most notably, CVE-2026-22769, a hardcoded credential flaw in Dell RecoverPoint for Virtual Machines, was exploited as a zero day by the PRC linked threat cluster UNC6201 since mid 2024. Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability. | Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
BRICKSTORM, first documented last year in connection with the zero-day exploitation of Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) against the MITRE Corporation...
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Podľa portálu Bloomberg systémy F5 kompromitovala čínska štátom sponzorovaná skupina UNC5221 malvérom BrickStorm a zotrvala v sieti vyše 12 mesiacov. Na aktivity tejto skupiny súvisiace so šírením BrickStorm koncom septembra 2025 upozornila GTIG.
Google's threat intelligence team documented the actor delivering the BRICKSTORM backdoor, GRIMBOLT native backdoors, and the SLAYSTYLE webshell through this vulnerability.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM... the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM.
Mandiant (part of Google Cloud) just published a comprehensive defender’s guide on securing VMware vSphere environments against the BRICKSTORM backdoor and associated malware activity.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
The attacker’s workstation, sitting somewhere outside the victim’s network, connected to the organization’s web-based SSL VPN.
Volexity found that VerdantBamboo had set up persistence for the BRICKSTORM implant by modifying the file /etc/rc.d/cron to include a single line to execute the implant.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.
the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
Volexity found that VerdantBamboo had set up persistence for the BRICKSTORM implant by modifying the file /etc/rc.d/cron to include a single line to execute the implant.
The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate
Instead of connecting to Egnyte’s own infrastructure, it was quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS, a technique that neatly disguised the malicious traffic. | The device was an Egnyte Storage Sync appliance... quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS.
Communicates with its C2 infrastructure over WebSockets, with some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment.
They contain three core task extensions: ... socks A Socks5 proxy server implementation
deploy additional malware to a Synology Network Attached Storage (NAS) appliance
GRIMBOLT... provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
127 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BRICKSTORM5
Backdoor delivered by UNC6201 via exploitation of Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769.
A stealthy backdoor targeting VMware hypervisor and Windows environments, enabling lateral movement, network tunnelling, and automatic reinstallation for long-term persistence in protected networks.
Tags: BRICKSTORM ... PLENET ... VerdantBamboo ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.