CISA Releases New Indicators of Compromise Tied to BRICKSTORM Malware
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the Canadian Centre for Cyber Security (Cyber Centre), has updated the indicators of compromise (IOCs) and detection signatures for…
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the Canadian Centre for Cyber Security (Cyber Centre), has updated the indicators of compromise (IOCs) and detection signatures for the BRICKSTORM malware.
On Fri, Dec 19, 2025, a new analysis was released, adding three more malware samples to the previous eight, resulting in a total of 11 analyzed variants.
BRICKSTORM is a backdoor malware linked to state-sponsored cyber actors from the People's Republic of China (PRC). It targets organizations in the Government Services and Facilities and Information Technology sectors, with a special focus on VMware vSphere environments, including VMware vCenter servers and VMware ESXi platforms.
The malware is custom-built using Go or Rust programming languages and functions as an Executable and Linkable Format (ELF) backdoor. The original eight samples were Go-based, while two of the three new samples are Rust-based, indicating evolving threat actor techniques.
On Fri, Dec 19, 2025, a new analysis was released, adding three more malware samples to the previous eight, resulting in a total of 11 analyzed variants.
BRICKSTORM provides cyber actors with comprehensive system control, employing multiple layers of encryption, such as HTTPS, WebSockets, and nested Transport Layer Security (TLS), to conceal communications with command-and-control servers. It also uses DNS-over-HTTPS (DoH) and mimics legitimate web server functionality to blend malicious traffic with regular network activity.
CISA conducted an incident response engagement where PRC actors gained access to a victim's internal network in April 2024, uploading BRICKSTORM to a VMware vCenter server. They compromised domain controllers and an Active Directory Federation Services (ADFS) server, exporting cryptographic keys. The malware provided persistent access from April 2024 through September 2025.
CISA, NSA, and Cyber Centre urge organizations to use the released IOCs and detection signatures, including YARA and Sigma rules, to identify BRICKSTORM samples. If detected, incidents should be reported to CISA, Cyber Centre, or appropriate authorities. IOCs are available in STIX format, and Sigma detection rules in YAML format, accessible through CISA's official website.
This advisory highlights the sophistication of state-sponsored cyber operations and the need for robust detection and response capabilities, particularly in government and critical infrastructure sectors.
Based on reporting by Cyber Security News.