CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems

According to CISA, BRICKSTORM is a sophisticated backdoor for VMware vSphere and Windows environments that enables long-term, stealthy access to compromised systems. The backdoor, written in Golang, provides interactive shell access and can browse, upload, download, create, delete, and manipulate files, while supporting multiple C2 channels such as HTTPS, WebSockets, and DNS-over-HTTPS, and can act as a SOCKS proxy to aid lateral movement.

CISA notes that BRICKSTORM is used mainly against governments and IT sectors and can automatically reinstall or restart itself to maintain operation. The agency also says the threats have been linked to two clusters, UNC5221 and Warp Panda, with Warp Panda described by CrowdStrike as a China-nexus adversary focused on persistent, covert access to networks.

In April 2024, one detected case saw attackers access a DMZ web server, move to an internal VMware vCenter, and implant BRICKSTORM, with further activity tied to targeting edge devices and cloud services. The report highlights BRICKSTORM’s use of a virtual socket interface to facilitate data exfiltration and inter-VM communication, underscoring its persistence and operational stealth.