CISA BRICKSTORM UNC5221 AR25-338A February 2026

BRICKSTORM has commands that allow the actor download files from the compromised host to the C2 server, and to also download specific sections of a file.

BRICKSTORM has utilized XOR cipher encryption to hide key strings within their code, to include IPv4 addresses of public DNS-over-HTTPS (DOH) servers.

BRICKSTORM has appeared to resemble legitimate processes to include the vCenter process `vami-http`. BRICKSTORM has also leveraged legitimate names of VMware vSphere platform such as `vmsrc` or `vmware-sphere`.

BRICKSTORM has uploaded files from the victim system to C2 servers.

BRICKSTORM has the ability to check if it is running as an active child process through the detection of a specific environment variable.

BRICKSTORM has the ability to delete files and directories. BRICKSTORM also has deleted installer files after execution to reduce detection.

BRICKSTORM has copied itself to the `usr/sbin/` folder.

BRICKSTORM has communicated to hardcoded C2 through WebSockets (WSS) to include domains associated with Cloudflare Workers. BRICKSTORM has also leveraged Gorilla mux library to serve its HTTP API calls.

BRICKSTORM has used DNS over HTTPS to resolve C2 infrastructure and obscure DNS traffic from inspection.

BRICKSTORM has identified specific files and directories within targeted hosts and systems for modification, execution, collection and exfiltration.

BRICKSTORM has leveraged SOCKS Proxy to pivot into victim networks in attempts to resemble legitimate administrative traffic.

BRICKSTORM has the ability to download files from the Adversaries C2 server to the compromised system.

BRICKSTORM has decoded its encrypted C2 traffic prior to execution. BRICKSTORM also has the ability to decode its obfuscated payload before execution.

BRICKSTORM has terminated an existing process to ensure that its own new process can execute.

BRICKSTORM has created a new background session and has spawned a child process of a parent process when it determines it is not running in its intended state.

BRICKSTORM has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints. BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.

BRICKSTORM has communicated with C2 infrastructure via TLS.

BRICKSTORM has checked hard-coded paths of `/etc/sysconfig/` or `/etc/sysconfig/network` prior to execution and loading file contents from that path.

BRICKSTORM has impaired command logging through the use of `dev/null` which prevents generating output from the command and does not wait for input.