Log in Request a demo

Malware profile

BRICKSTORM backdoor

BRICKSTORM is a backdoor that hides on VMware vCenter servers, ESXi hosts and network appliances.

In short

BRICKSTORM is a backdoor that hides on VMware vCenter servers, ESXi hosts and network appliances. CISA, the NSA and the Canadian Cyber Centre assess that PRC state-sponsored cyber actors use it for long-term persistence on victim systems, mainly in the government services and information technology sectors. Google Threat Intelligence Group attributes the activity to UNC5221 and closely related, suspected China-nexus clusters.

Last updated 19 October 2026

Profile MapMalware
  1. Names5names in public reportsBRICKSTORM · vami-httpd · vmsrc, vmware-sphere
  2. Techniques14ATT&CK techniques listedCommand and Control · Execution · Stealth
  3. Infection Steps5in the delivery chainWeb server reached · Logins taken
  4. Linked Groups1groups that use itARMORY CASTLE

In one minute

What it is
A backdoor for VMware vCenter, ESXi and network appliances. Most samples are written in Go or Rust, and a 2026 variant is a .NET application compiled ahead of time.
What it does
It gives the operator an interactive shell, file management and a SOCKS proxy, hides its command traffic inside HTTPS, WebSockets and nested TLS, and reinstalls itself if disrupted.
Who uses it
Attributed by CISA, the NSA and the Canadian Cyber Centre to PRC state-sponsored actors. Attributed by Google Threat Intelligence Group to UNC5221 and close clusters. GTIG now calls UNC5221 ARMORY CASTLE.
How it gets in
Operators install it after they already have access, often from an edge device or a web server. In one CISA incident response case they reached vCenter with managed service provider credentials taken from a copied Active Directory database.
What to do first
Scan vCenter, ESXi, appliances and their backups with the published YARA and Sigma rules, and block unauthorized DNS over HTTPS traffic.

What it does

BRICKSTORM gives its operators full control of the compromised host through three custom handlers that CISA describes in detail. A SOCKS handler relays traffic so the operators can move laterally to other systems. A web service handler hides an API for browsing, uploading, downloading and deleting files. A command handler opens an interactive shell. GTIG says the actor deploys it on appliances that cannot run endpoint detection tools, and that intrusions stayed undetected for 393 days on average.

GTIG ties BRICKSTORM to UNC5221, now tracked as ARMORY CASTLE and covered in our ARMORY CASTLE threat group profile. In 2026 that group used the SAWFLY web shell and the BARECLAW tunneler, but GTIG does not name BRICKSTORM there. Mandiant first described BRICKSTORM in April 2024, after UNC5221 compromised an Ivanti Connect Secure gateway and moved to a vCenter server. The intrusion began with the Ivanti authentication bypass CVE-2023-46805 and the Ivanti command injection CVE-2024-21887.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
BRICKSTORMName used by Mandiant, CISA, the NSA, the Canadian Cyber Centre and MITRE ATT&CK (S9015)[1, 2, 3, 4]
vami-httpdFile name an early sample copied itself to on vCenter[3]
vmsrc, vmware-sphereFile names of one sample taken from a vSphere platform[1]
updatemgrFile name that several samples copy themselves to[1]
sqiudProcess name of the 2026 .NET variant, a deliberate typo of the squid proxy[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Command and Control

  • Application Layer Protocol: DNS T1071.004

    Resolves its command server through public DNS over HTTPS resolvers, so the lookup stays encrypted.[1, 4]

  • Application Layer Protocol: Web Protocols T1071.001

    Communicates over HTTPS and WebSockets, and serves ordinary web files to look like a legitimate web server.[1, 4]

  • Encrypted Channel: Asymmetric Cryptography T1573.002

    Wraps its traffic in nested TLS layers inside the WebSocket session.[1, 4]

  • Proxy: Internal Proxy T1090.001

    Runs a SOCKS proxy that routes command traffic and lets operators move laterally inside the network.[1, 2, 4]

  • Protocol Tunneling T1572

    Multiplexes many streams over one encrypted connection and tunnels the operator's workstation into the network.[1, 2, 4]

  • Dynamic Resolution T1568

    Some samples use sslip.io or nip.io addresses that resolve directly to the command server.[2, 4]

  • Ingress Tool Transfer T1105

    Can download files from the command server onto the compromised host.[1, 4]

Execution

  • Command and Scripting Interpreter: Unix Shell T1059.004

    Opens an interactive pseudo-terminal so operators can run arbitrary shell commands.[1, 4]

Stealth

  • Hijack Execution Flow: Path Interception by PATH Environment Variable T1574.007

    Appends the location of its copy to the PATH variable, so the copy runs first.[1, 4]

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    Uses file names that imitate VMware components, such as vmware-sphere or vami-httpd.[1, 3, 4]

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    Hides key strings, such as resolver addresses, with XOR encryption.[1, 4]

  • Delay Execution T1678

    One sample waited for a hard-coded date months in the future before it began to beacon.[2, 4]

Discovery

  • File and Directory Discovery T1083

    Lists directory contents on the compromised system.[1, 4]

Exfiltration

  • Exfiltration Over C2 Channel T1041

    Uploads files from the victim system to the command server.[1, 4]

How it spreads

BRICKSTORM does not spread on its own. Operators install it on a host they already control, usually over SSH with legitimate credentials taken earlier in the intrusion. GTIG observed them enabling SSH through the vCenter Appliance Management Interface or the ESXi web interface before installation. In several cases they deployed it on a network appliance first and then pivoted to VMware systems.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Web server reached

    In April 2024 the actors accessed a web server in the DMZ through an existing web shell.[1]

  2. Logins taken

    They moved laterally over RDP with service account credentials and copied the Active Directory database.[1]

  3. vCenter reached

    Using managed service provider credentials from that database, they moved on to the vCenter server.[1]

  4. Backdoor planted

    They elevated privileges with sudo, dropped BRICKSTORM in a system directory and modified the init file so it runs at boot.[1]

  5. Long stay

    BRICKSTORM provided persistent access from at least April 2024 through at least 3 September 2025.[1]

Timeline

  1. 4 April 2024

    First public analysis

    Mandiant describes BRICKSTORM on a vCenter server after UNC5221 broke into an Ivanti Connect Secure gateway.[3]

  2. April 2024

    CISA case begins

    Actors gain persistent access to an organization where CISA later conducted incident response, and plant BRICKSTORM on vCenter.[1]

  3. March 2025

    Mandiant cases

    Mandiant begins responding to BRICKSTORM intrusions across several industries in the United States.[2]

  4. 24 September 2025

    GTIG report

    GTIG attributes the activity to UNC5221 and reports an average of 393 days of undetected access.[2]

  5. 4 December 2025

    Joint report

    CISA, the NSA and the Canadian Cyber Centre publish report AR25-338A on eight samples.[1, 5]

  6. 19 December 2025

    Rust samples

    The agencies add three samples to the report, two of them written in Rust.[1]

  7. 11 February 2026

    New variant

    The agencies add a twelfth sample, a .NET variant compiled ahead of time that needs no runtime on the host.[1]

  8. 16 April 2026

    MITRE entry

    MITRE ATT&CK adds BRICKSTORM as software S9015.[4]

  9. 15 October 2026

    New group name

    GTIG says it now tracks UNC5221 as ARMORY CASTLE.[6]

Detection and defense

  1. Scan with the published rules

    Run the CISA YARA and Sigma rules from AR25-338A and the Mandiant BRICKSTORM scanner on vCenter, ESXi, appliances and backups.[1, 2]

    Counters: T1036.005 T1027.013

  2. Block unknown DNS over HTTPS

    Block unauthorized DNS over HTTPS providers and external DoH network traffic to reduce unmonitored communications.[1, 5]

    Counters: T1071.004

  3. Watch your edge devices

    Keep an inventory of every edge device and appliance, and treat outbound connections to addresses the manufacturer does not control as a reason for forensic review.[1, 2]

    Counters: T1071.001 T1090.001

  4. Split the DMZ

    Restrict traffic from the DMZ to the internal network, and disable RDP and SMB along that path.[1]

    Counters: T1090.001 T1572

  5. Harden vSphere

    Upgrade vSphere, enforce multi-factor authentication for web logins, enable lockdown mode and forward logs to a central SIEM.[1, 2]

    Counters: T1059.004

  6. Read the vCenter logs

    Search VPXD and audit logs for virtual machines cloned and quickly deleted, new local accounts and SSH being enabled.[2]

    Counters: T1059.004

Questions

What is BRICKSTORM?

A backdoor for VMware vCenter, ESXi and network appliances, with versions written in Go, Rust and .NET. It gives attackers an interactive shell, file management and a SOCKS proxy.

Who uses BRICKSTORM?

CISA, the NSA and the Canadian Cyber Centre say PRC state-sponsored actors use it. Google Threat Intelligence Group ties it to UNC5221, now called ARMORY CASTLE, and to close clusters.

Why is it hard to find?

It runs on appliances that often cannot host endpoint detection tools, hides its traffic in several layers of encryption and reinstalls itself. GTIG reports 393 days of undetected access on average.

How do I check for it?

Run the CISA YARA and Sigma rules from report AR25-338A and the Mandiant scanner on appliances and backups. Then review vCenter logs for cloned virtual machines and new local accounts.

In our research

  1. ARMORY CASTLE Threat group

Sources

  1. BRICKSTORM Backdoor (AR25-338A) CISA, NSA and Canadian Centre for Cyber SecuritySupports: 4 December 2025, updated 11 February 2026: PRC state-sponsored actors, 12 samples, functions, incident case, ATT&CK mapping, YARA and Sigma rules, mitigations
  2. Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors Google Threat Intelligence Group (Mandiant)Supports: 24 September 2025: attribution to UNC5221 and close clusters, sectors, 393 day average dwell time, delay timer, hunting and hardening steps
  3. Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies MandiantSupports: 4 April 2024: first public analysis, BRICKSTORM on vCenter after the Ivanti compromise, vami-httpd name
  4. BRICKSTORM, Software S9015 MITRE ATT&CKSupports: Platforms, technique ids and names, first observed April 2024
  5. PRC State-Sponsored Actors Use BRICKSTORM Malware Across Public Sector and Information Technology Systems CISASupports: 4 December 2025 alert: affected sectors and first actions for defenders
  6. ARMORY CASTLE Exploits BeyondTrust Google Threat Intelligence Group (Mandiant)Supports: 15 October 2026: UNC5221 now tracked as ARMORY CASTLE

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Backdoor

A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.

Read more

Glossary term

Persistence

Persistence is the set of actions an attacker takes to keep access to a system after the first break-in.

Read more

Malware

SAWFLY web shell

SAWFLY is a small PHP web shell that Google Threat Intelligence Group says a suspected China-nexus espionage group used on BeyondTrust Remote Support appliances in 2026.

Read more

Malware

BARECLAW tunneler

BARECLAW is a tunneler written in C that Google Threat Intelligence Group says a suspected China-nexus espionage group ran on a BeyondTrust Remote Support appliance in 2026.

Read more