MITRE ATT&CKsoftware (malware)

S9012 TRAILBLAZE

Published 2026-04-14 Modified 2026-04-23 Official page ↗

Domain: enterprise
Platforms: Linux, Network Devices
Version: 1.0
Created: 2026-04-14

Description

TRAILBLAZE is an in-memory dropper used to deploy the passive backdoor BRUSHFIRE. First reported in March 2025, TRAILBLAZE has been observed in operations attributed to People's Republic of China (PRC) state-sponsored affiliated actors, including UNC5221 and SYLVANITE.

Uses · MITRE ATT&CK (4)

T1070.004 File Deletion sub-technique
T1055.012 Process Hollowing sub-technique
T1057 Process Discovery technique
T1106 Native API technique

References

https://hub.dragos.com/hubfs/2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en Dragos SYLVANITE MuddyWater Electrum March 2026
https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability Google UNC5221 Ivanti April 2025
https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure Picus Security UNC5221 Ivanti May 2025

S9012 TRAILBLAZE

Description

Related

Uses · MITRE ATT&CK (4)

References