MITRE ATT&CKsoftware (malware)

S9015 BRICKSTORM

Published 2026-04-16 Modified 2026-04-23 Official page ↗
Domain
enterprise
Platforms
ESXi, Linux, Network Devices, Windows
Version
1.0
Created
2026-04-16

Description

BRICKSTORM is a cross-platform backdoor with variants written in Go and Rust that facilitates command and control, the ingress transfer of other malware, and the exfiltration of data. BRICKSTORM has also been created from a .NET application using ahead-of-time (AOT) compilation to blend in within victim environments. BRICKSTORM was first observed in April 2024. BRICKSTORM has previously been leveraged by People's Republic of China (PRC) state-nexus actors identified as UNC6201, UNC5221, WARP PANDA, PunyToad, and SYLVANITE.

Related

Uses · MITRE ATT&CK (25)

  • T1690 Prevent Command History Logging technique
  • T1678 Delay Execution technique
  • T1070.010 Relocate Malware sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.001 Internal Proxy sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1568 Dynamic Resolution technique
  • T1059.004 Unix Shell sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1543 Create or Modify System Process technique
  • T1489 Service Stop technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1027 Obfuscated Files or Information technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1083 File and Directory Discovery technique
  • T1102 Web Service technique
  • T1105 Ingress Tool Transfer technique

References