Skip to content
NewCybercrime Report 2026 · Eight Chapters · A Post Is Not An Incident → Explore The ChaptersCybercrime Report 2026 → Explore
Request A Demo
Malware Profile

BRICKSTORM Backdoor.

BRICKSTORM is a backdoor that hides on VMware vCenter servers, ESXi hosts and network appliances.

What It Can Do ↓ How To Find It
Malware or tool
Type Remote access trojan
First seen 2024
Platforms ESXi, Linux, Network Devices, Windows
In Short

BRICKSTORM is a backdoor that hides on VMware vCenter servers, ESXi hosts and network appliances. CISA, the NSA and the Canadian Cyber Centre assess that PRC state-sponsored cyber actors use it for long-term persistence on victim systems, mainly in the government services and information technology sectors. Google Threat Intelligence Group attributes the activity to UNC5221 and closely related, suspected China-nexus clusters.

At A Glance
Type Remote access trojan
First seen 2024
Platforms ESXi, Linux, Network Devices, Windows
Names 1names in public reports BRICKSTORM Techniques 14ATT&CK techniques listed Command and Control · Execution · Stealth Infection Steps 5in the delivery chain Web server reached · Logins taken Linked Groups 1groups that use it ARMORY CASTLE
01In One Minute

In One Minute.

What it is A backdoor for VMware vCenter, ESXi and network appliances. Most samples are written in Go or Rust, and a 2026 variant is a .NET application compiled ahead of time.
What it does It gives the operator an interactive shell, file management and a SOCKS proxy, hides its command traffic inside HTTPS, WebSockets and nested TLS, and reinstalls itself if disrupted.
Who uses it Attributed by CISA, the NSA and the Canadian Cyber Centre to PRC state-sponsored actors. Attributed by Google Threat Intelligence Group to UNC5221 and close clusters. GTIG now calls UNC5221 ARMORY CASTLE.
How it gets in Operators install it after they already have access, often from an edge device or a web server. In one CISA incident response case they reached vCenter with managed service provider credentials taken from a copied Active Directory database.
What to do first Scan vCenter, ESXi, appliances and their backups with the published YARA and Sigma rules, and block unauthorized DNS over HTTPS traffic.
02What It Does

What It Does.

BRICKSTORM gives its operators full control of the compromised host through three custom handlers that CISA describes in detail.

Handler 01 SOCKS handler A SOCKS handler relays traffic so the operators can move laterally to other systems.
Handler 02 Web service handler A web service handler hides an API for browsing, uploading, downloading and deleting files.
Handler 03 Command handler A command handler opens an interactive shell.

GTIG says the actor deploys it on appliances that cannot run endpoint detection tools, and that intrusions stayed undetected for 393 days on average.

GTIG ties BRICKSTORM to UNC5221, now tracked as ARMORY CASTLE and covered in our ARMORY CASTLE threat group profile. In 2026 that group used the SAWFLY web shell and the BARECLAW tunneler, but GTIG does not name BRICKSTORM there. Mandiant first described BRICKSTORM in April 2024, after UNC5221 compromised an Ivanti Connect Secure gateway and moved to a vCenter server. The intrusion began with the Ivanti authentication bypass CVE-2023-46805 and the Ivanti command injection CVE-2024-21887.

03Names

Names.

Public sources use several names for this malware.

BRICKSTORM Name used by Mandiant, CISA, the NSA, the Canadian Cyber Centre and MITRE ATT&CK (S9015) 1234
04What It Can Do

What It Can Do.

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

T1071.004 T1071.001 T1573.002 T1090.001 T1572 T1568 T1105 T1059.004 T1574.007 T1036.005 T1027.013 T1678 T1083 T1041 BRICKSTORM 7 COMMAND AND CONTROL
Command and Control · 7 techniques
Application Layer Protocol: DNS T1071.004 ↗ Resolves its command server through public DNS over HTTPS resolvers, so the lookup stays encrypted. [1, 4]
Application Layer Protocol: Web Protocols T1071.001 ↗ Communicates over HTTPS and WebSockets, and serves ordinary web files to look like a legitimate web server. [1, 4]
Encrypted Channel: Asymmetric Cryptography T1573.002 ↗ Wraps its traffic in nested TLS layers inside the WebSocket session. [1, 4]
Proxy: Internal Proxy T1090.001 ↗ Runs a SOCKS proxy that routes command traffic and lets operators move laterally inside the network. [1, 2, 4]
Protocol Tunneling T1572 ↗ Multiplexes many streams over one encrypted connection and tunnels the operator’s workstation into the network. [1, 2, 4]
Dynamic Resolution T1568 ↗ Some samples use sslip.io or nip.io addresses that resolve directly to the command server. [2, 4]
Ingress Tool Transfer T1105 Can download files from the command server onto the compromised host. [1, 4]
05How It Spreads

How It Spreads.

BRICKSTORM does not spread on its own.

Operators install it on a host they already control, usually over SSH with legitimate credentials taken earlier in the intrusion. GTIG observed them enabling SSH through the vCenter Appliance Management Interface or the ESXi web interface before installation. In several cases they deployed it on a network appliance first and then pivoted to VMware systems.

06How An Infection Runs

How An Infection Runs.

The order of steps in a typical infection, as the sources describe it.

  1. 01 Web server reached In April 2024 the actors accessed a web server in the DMZ through an existing web shell. [1]
  2. 02 Logins taken They moved laterally over RDP with service account credentials and copied the Active Directory database. [1]
  3. 03 vCenter reached Using managed service provider credentials from that database, they moved on to the vCenter server. [1]
  4. 04 Backdoor planted They elevated privileges with sudo, dropped BRICKSTORM in a system directory and modified the init file so it runs at boot. [1]
  5. 05 Long stay BRICKSTORM provided persistent access from at least April 2024 through at least 3 September 2025. [1]
07Timeline

Timeline.

20242 entries
4 April 2024 First public analysis Mandiant describes BRICKSTORM on a vCenter server after UNC5221 broke into an Ivanti Connect Secure gateway. [3]
April 2024 CISA case begins Actors gain persistent access to an organization where CISA later conducted incident response, and plant BRICKSTORM on vCenter. [1]
20254 entries
March 2025 Mandiant cases Mandiant begins responding to BRICKSTORM intrusions across several industries in the United States. [2]
24 September 2025 GTIG report GTIG attributes the activity to UNC5221 and reports an average of 393 days of undetected access. [2]
4 December 2025 Joint report CISA, the NSA and the Canadian Cyber Centre publish report AR25-338A on eight samples. [1, 5]
19 December 2025 Rust samples The agencies add three samples to the report, two of them written in Rust. [1]
20263 entries
11 February 2026 New variant The agencies add a twelfth sample, a .NET variant compiled ahead of time that needs no runtime on the host. [1]
16 April 2026 MITRE entry MITRE ATT&CK adds BRICKSTORM as software S9015. [4]
15 October 2026 New group name GTIG says it now tracks UNC5221 as ARMORY CASTLE. [6]
08Who Uses It

Who Uses It.

Threat groupChina (suspected) ARMORY CASTLE Google Threat Intelligence Group attributes the zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764), which it dates to late August 2026, to ARMORY CASTLE, a suspected China-linked spying group it formerly tracked as UNC5221.
09Related Vulnerabilities

Related Vulnerabilities.

CVE-2023-46805 Ivanti authentication bypass (CVE-2023-46805) CVE-2023-46805 is an authentication bypass in the web component of Ivanti Connect Secure and Ivanti Policy Secure. CVE-2023-46805 · Ivanti · Authentication bypass (CWE-287) CVE-2024-21887 Ivanti command injection (CVE-2024-21887) CVE-2024-21887 is a command injection flaw in the web components of Ivanti Connect Secure and Ivanti Policy Secure. CVE-2024-21887 · Ivanti · Command injection (CWE-77)
10Detection And Defense

Detection And Defense.

01 Scan with the published rules Run the CISA YARA and Sigma rules from AR25-338A and the Mandiant BRICKSTORM scanner on vCenter, ESXi, appliances and backups. [1, 2]
Counters T1036.005T1027.013
02 Block unknown DNS over HTTPS Block unauthorized DNS over HTTPS providers and external DoH network traffic to reduce unmonitored communications. [1, 5]
Counters T1071.004
03 Watch your edge devices Keep an inventory of every edge device and appliance, and treat outbound connections to addresses the manufacturer does not control as a reason for forensic review. [1, 2]
Counters T1071.001T1090.001
04 Split the DMZ Restrict traffic from the DMZ to the internal network, and disable RDP and SMB along that path. [1]
Counters T1090.001T1572
05 Harden vSphere Upgrade vSphere, enforce multi-factor authentication for web logins, enable lockdown mode and forward logs to a central SIEM. [1, 2]
Counters T1059.004
06 Read the vCenter logs Search VPXD and audit logs for virtual machines cloned and quickly deleted, new local accounts and SSH being enabled. [2]
Counters T1059.004
11Questions

Questions.

A backdoor for VMware vCenter, ESXi and network appliances, with versions written in Go, Rust and .NET. It gives attackers an interactive shell, file management and a SOCKS proxy.

12In Our Research

In Our Research.

ARMORY CASTLE → Threat group
13Sources

Sources.

  1. 1BRICKSTORM Backdoor (AR25-338A)CISA, NSA and Canadian Centre for Cyber Security · Supports: 4 December 2025, updated 11 February 2026: PRC state-sponsored actors, 12 samples, functions, incident case, ATT&CK mapping, YARA and Sigma rules, mitigations
  2. 2Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal SectorsGoogle Threat Intelligence Group (Mandiant) · Supports: 24 September 2025: attribution to UNC5221 and close clusters, sectors, 393 day average dwell time, delay timer, hunting and hardening steps
  3. 3Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case StudiesMandiant · Supports: 4 April 2024: first public analysis, BRICKSTORM on vCenter after the Ivanti compromise, vami-httpd name
  4. 4BRICKSTORM, Software S9015MITRE ATT&CK · Supports: Platforms, technique ids and names, first observed April 2024
  5. 5PRC State-Sponsored Actors Use BRICKSTORM Malware Across Public Sector and Information Technology SystemsCISA · Supports: 4 December 2025 alert: affected sectors and first actions for defenders
  6. 6ARMORY CASTLE Exploits BeyondTrustGoogle Threat Intelligence Group (Mandiant) · Supports: 15 October 2026: UNC5221 now tracked as ARMORY CASTLE
Brandefense platform Cyber Threat Intelligence. Brandefense Cyber Threat Intelligence tracks malware families and the infrastructure they use, and shares indicators your team can check against its own systems.
See how it works →
14Browse The Threat Library

Browse The Threat Library.

APT groups State-backed hacking groups, who they go after and how they get in. 52 Countries The sectors, groups and national bodies that matter in each country. 32 Ransomware groups How each group gets in, how it extorts and what stops it. 26 Malware and toolsYou are here Malware families and abused tools, what they do and how to spot them. 58 Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 Vulnerabilities Flaws attackers use in real attacks and what to do about them. 77 Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109
15Keep Exploring

Keep Exploring.

Knowledge Hub →
Glossary term Backdoor A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk. Read more → Glossary term Persistence Persistence is the set of actions an attacker takes to keep access to a system after the first break-in. Read more → Malware SAWFLY web shell SAWFLY is a small PHP web shell that Google Threat Intelligence Group says a suspected China-nexus espionage group used on BeyondTrust Remote Support appliances in 2026. Read more → Malware BARECLAW tunneler BARECLAW is a tunneler written in C that Google Threat Intelligence Group says a suspected China-nexus espionage group ran on a BeyondTrust Remote Support appliance in 2026. Read more →
Brandefense logo

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request A Demo → All Malware And Tools