BRICKSTORM backdoor exposed: CISA warns of advanced China-backed intrusions

BRICKSTORM is a Go-based backdoor exposed by CISA as a tool used by PRC state-sponsored actors to secure long-term persistence on compromised systems, with targets including government services and information technology sectors. According to CISA, BRICKSTORM uses multiple encryption layers, a SOCKS proxy for lateral movement, DNS-over-HTTPS, and can function as a web server to maintain covert C2.

A joint CISA/NSA/Cyber Centre report notes that attackers gained access by stealing credentials and targeting VMware vSphere to harvest VM snapshots and create hidden rogue VMs, enabling persistent access for extended periods. In one detected case, attackers moved from a DMZ web server to VMware vCenter, exfiltrated cryptographic keys, and accessed domain controllers and an ADFS server, with BRICKSTORM installed to sustain presence from at least April 2024 through Sept 3, 2025.

Google Threat Intelligence Group observed BRICKSTORM activity targeting U.S. organisations since March 2025, while Mandiant linked the activity to the UNC5221 China-nexus APT group. Researchers say these intrusions reflect China’s shift toward exploiting edge devices to penetrate networks and cloud environments.