# BRICKSTORM Backdoor: UNC5221 PRC-Nexus APT Targeting VMware vSphere Infrastructure

> PRC state-sponsored threat actor UNC5221 deploys BRICKSTORM, a Go/Rust-based cross-platform backdoor targeting VMware vSphere (vCenter, ESXi), Linux, Windows, and BSD systems. CISA/NSA/CCCS joint advisory AR25-338A (updated Feb 2026) documents 12+ analyzed samples. The campaign achieves an average dwell time of 393 days, targeting US legal, technology, SaaS, and BPO sectors, as well as European critical infrastructure, for long-term espionage operations.

- **Published:** 2026-04-02T12:00:00Z
- **Last reviewed:** 2026-04-02T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0313
- **ID:** TL-2026-0313
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNC5221 (China)
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-46805, CVE-2024-21887

## Description

BRICKSTORM is a sophisticated, modular backdoor attributed to UNC5221, a China-nexus advanced persistent threat (APT) cluster tracked by Mandiant/Google Cloud Threat Intelligence. The malware is written in Go (with newer Rust-based variants identified in December 2025) and is designed for deployment on network appliances and virtualization infrastructure that typically lack traditional endpoint detection and response (EDR) coverage.

The backdoor provides extensive capabilities including: acting as a web server, file system and directory manipulation (upload/download), shell command execution, and SOCKS proxy relay functionality. BRICKSTORM communicates with command-and-control (C2) infrastructure via WebSockets over TLS, employing multiple layers of encryption including nested TLS channels and DNS-over-HTTPS (DoH) to resolve C2 domains. The malware leverages legitimate cloud services — Cloudflare Workers and Heroku applications — for C2 infrastructure, with unique domains per victim to frustrate tracking.

The BRICKSTORM ecosystem includes several companion tools: BRICKSTEAL, a malicious Java Servlet filter deployed on Apache Tomcat that intercepts vCenter web login requests to capture credentials from HTTP Basic authentication headers; SLAYSTYLE (tracked by MITRE as BEEFLUSH), a JSP web shell that executes arbitrary OS commands via HTTP requests; and custom in-memory droppers that modify runtime configurations without touching disk.

UNC5221 gains initial access by exploiting public-facing edge appliances, notably Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887) and VMware management interfaces. Post-compromise, the actor achieves persistence through modification of systemd units, init.d scripts, rc.local files, and PATH hijacking. The group employs sophisticated lateral movement techniques including VM cloning of Domain Controllers and Identity Providers for offline credential extraction (NTDS.dit), SSH-based movement using harvested credentials, and abuse of Microsoft Entra ID Enterprise Applications with mail.read or full_access_as_app scopes for email exfiltration.

The campaign has been active since at least November 2022 targeting European Windows environments, with multiple US intrusions responded to since March 2025. BRICKSTORM samples use Garble obfuscation and XOR cipher encryption to hide key strings including DoH server addresses. The malware includes self-healing persistence mechanisms with delayed-start logic that can postpone C2 communication for months following incident response activity. Across all investigations, no C2 domain or malware sample reuse has been observed across victims, indicating exceptionally high operational security.

CISA, NSA, and the Canadian Centre for Cyber Security (CCCS) have released three iterations of Malware Analysis Report AR25-338A (December 4, 2025; December 19, 2025; February 11, 2026) analyzing 12+ BRICKSTORM samples with YARA and Sigma detection rules. Mandiant has also released a free BRICKSTORM scanner script on GitHub for Linux and BSD appliances.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1037 Boot or Logon Initialization Scripts
- T1078 Valid Accounts
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1007 System Service Discovery
- T1021 Remote Services
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel

## Sources

- [CISA Malware Analysis Report AR25-338A: BRICKSTORM Backdoor](https://www.cisa.gov/news-events/analysis-reports/ar25-338a)
- [NSA/CISA/CCCS Joint Malware Analysis Report - BRICKSTORM (Updated Feb 2026)](https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF)
- [Google Cloud: vSphere and BRICKSTORM Malware - A Defender's Guide](https://cloud.google.com/blog/topics/threat-intelligence/vsphere-brickstorm-defender-guide/)
- [Google Cloud: Another BRICKSTORM - Stealthy Backdoor Enabling Espionage](https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign)
- [CISA Alert: PRC State-Sponsored Actors Use BRICKSTORM Malware](https://www.cisa.gov/news-events/alerts/2025/12/04/prc-state-sponsored-actors-use-brickstorm-malware-across-public-sector-and-information-technology)
- [CISA Update: Additional BRICKSTORM Samples Including Rust Variants](https://www.cisa.gov/news-events/alerts/2025/12/19/cisa-and-partners-release-update-malware-analysis-report-brickstorm-backdoor)
- [Canadian Centre for Cyber Security: Joint MAR on BRICKSTORM](https://www.cyber.gc.ca/en/news-events/joint-malware-analysis-report-brickstorm-backdoor)
- [Mandiant BRICKSTORM Scanner - GitHub](https://github.com/mandiant/brickstorm-scanner)
- [NVISO Analyzes BRICKSTORM Espionage Backdoor](https://www.nviso.eu/blog/nviso-analyzes-brickstorm-espionage-backdoor)
- [The Hacker News: UNC5221 Uses BRICKSTORM to Infiltrate US Legal and Tech](https://thehackernews.com/2025/09/unc5221-uses-brickstorm-backdoor-to.html)
- [SOC Prime: BRICKSTORM Malware Detection - UNC5221](https://socprime.com/blog/brickstorm-backdoor-detection/)
- [Picus Security: BRICKSTORM Malware UNC5221 Targets Tech and Legal](https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states)
- [ExtraHop: The BRICKSTORM Campaign - UNC5221](https://www.extrahop.com/blog/the-brickstorm-campaign-unc5221)
- [CrowdStrike: Unveiling WARP PANDA - China-Nexus Adversary](https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/)
- [SafeBreach Coverage: CISA AR25-338A BrickStorm Backdoor](https://www.safebreach.com/blog/safebreach-coverage-for-updated-cisa-ar25-338a-brickstorm-backdoor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0313