Malware.View on attack.mitre.org
BRICKSTORM is a cross-platform backdoor with variants written in Go and Rust that facilitates command and control, the ingress transfer of other malware, and the exfiltration of data. BRICKSTORM has also been created from a .NET application using ahead-of-time (AOT) compilation to blend in within victim environments. BRICKSTORM was first observed in April 2024. BRICKSTORM has previously been leveraged by People's Republic of China (PRC) state-nexus actors identified as UNC6201, UNC5221, WARP PANDA, PunyToad, and SYLVANITE.
| Technique | Procedure example |
|---|---|
| T1005 Data from Local System |
BRICKSTORM has commands that allow the actor download files from the compromised host to the C2 server, and to also download specific sections of a file. |
| T1027 Obfuscated Files or Information |
BRICKSTORM has utilized Go libraries to include Garble to obfuscate code. |
| T1027.013 Encrypted/Encoded File |
BRICKSTORM has utilized XOR cipher encryption to hide key strings within their code, to include IPv4 addresses of public DNS-over-HTTPS (DOH) servers. |
| T1036.005 Match Legitimate Resource Name or Location |
BRICKSTORM has appeared to resemble legitimate processes to include the vCenter process `vami-http`. BRICKSTORM has also leveraged legitimate names of VMware vSphere platform such as `vmsrc` or `vmware-sphere`. |
| T1041 Exfiltration Over C2 Channel |
BRICKSTORM has uploaded files from the victim system to C2 servers. CISA BRICKSTORM UNC5221 AR25-338A February 2026CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025Google BRICKSTORM September 2025Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024NVISO BRICKSTORM April 2025Picus Security BRICKSTORM UNC5221 October 2025Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025 |
| T1057 Process Discovery |
BRICKSTORM has the ability to check if it is running as an active child process through the detection of a specific environment variable. |
| T1059.004 Unix Shell |
BRICKSTORM has executed shell commands using `/bin/sh`. |
| T1070.004 File Deletion |
BRICKSTORM has the ability to delete files and directories. BRICKSTORM also has deleted installer files after execution to reduce detection. |
| T1070.010 Relocate Malware |
BRICKSTORM has copied itself to the `usr/sbin/` folder. |
| T1071.001 Web Protocols |
BRICKSTORM has communicated to hardcoded C2 through WebSockets (WSS) to include domains associated with Cloudflare Workers. BRICKSTORM has also leveraged Gorilla mux library to serve its HTTP API calls. |
| T1071.004 DNS |
BRICKSTORM has used DNS over HTTPS to resolve C2 infrastructure and obscure DNS traffic from inspection. |
| T1083 File and Directory Discovery |
BRICKSTORM has identified specific files and directories within targeted hosts and systems for modification, execution, collection and exfiltration. |
| T1090.001 Internal Proxy |
BRICKSTORM has leveraged SOCKS Proxy to pivot into victim networks in attempts to resemble legitimate administrative traffic. |
| T1102 Web Service |
BRICKSTORM has leveraged DNS web services to resolve C2 IP addresses including sslip.io and nip.io. BRICKSTORM has also utilized Cloudflare Workers for C2 communications. |
| T1105 Ingress Tool Transfer |
BRICKSTORM has the ability to download files from the Adversaries C2 server to the compromised system. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
