SYMBOLCOMMON_NAMEaka. SYNONYMS
elf.brickstorm (Back to overview)

BRICKSTORM

Actor(s): UTA0178

According to Google, BRICKSTORM is used to consistently target appliances, among them primarily VMware vCenter and ESXi hosts.

References
2026-02-17 ⋅ Google ⋅ Daniel Sislo, Fernando Tomlinson, John Scarbrough, Jr., Nick Harbour, PETER UKHANOV, Rich Reece
From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day
BRICKSTORM GRIMBOLT SLAYSTYLE UNC6201
2025-12-04 ⋅ CISA ⋅ Canadian Centre for Cyber Security, CISA, NSA
Malware Analysis Report (MAR) BRICKSTORM Backdoor
BRICKSTORM
2025-12-04 ⋅ CrowdStrike ⋅ CrowdStrike Counter Adversary Operations
Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary
BRICKSTORM WARP PANDA
2025-10-16 ⋅ Qualys ⋅ Diksha Ojha
F5 BIG-IP Source Code Leaked in State-Linked Cyberattack (BRICKSTORM Malware)
BRICKSTORM
2025-09-24 ⋅ Google ⋅ Ashley Pearson, Austin Larsen, BRAD SLAYBAUGH, Doug Bienstock, Geoff Carstairs, John Wolfram, Josh Madeley, Josh Murchie, Matt Lin, Sarah Yoder
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
BRICKSTORM
2025-04-09 ⋅ nviso ⋅ NVISO
BRICKSTORM Backdoor Analysis
BRICKSTORM
2024-04-04 ⋅ Mandiant ⋅ Ashley Pearson, Austin Larsen, Billy Wong, John Wolfram, Joseph Pisano, Josh Murchie, Lukasz Lamparski, Matt Lin, Ron Craft, Ryan Hall, Shawn Chew, Tyler McLellan
Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies
BRICKSTORM TONERJAM UNC3569 UNC5266 UNC5291 UNC5330 UNC5337 UTA0178
2024-04-04 ⋅ Mandiant ⋅ Ashley Pearson, Austin Larsen, Billy Wong, John Wolfram, Joseph Pisano, Josh Murchie, Lukasz Lamparski, Matt Lin, Ron Craft, Ryan Hall, Shawn Chew, Tyler McLellan
Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies
BRICKSTORM TONERJAM

There is no Yara-Signature yet.