BRICKSTORM Backdoor

December 3, 2025 · CISA Advisories · Severity: CRITICAL

Malware Analysis at a Glance Malware Name     BRICKSTORM Original Publication Dec. 4, 2025  Last Update Feb. 11, 2026  Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. CISA, NSA, and Cyber Centre are releasing this Malware Analysis Report to share indicators of compromise (IOCs) and detection signatures based off analysis of 12 BRICKSTORM samples. CISA, NSA, and Cyber Centre urge organizations to use the IOCs and detection signatures to identify BRICKSTORM malware samples. Last Update Description CISA, NSA, and Cyber Centre updated this Malware Analysis Report on Feb. 11, 2026, with analysis, IOCs, and detection signatures from a new variant of BRICKSTORM. Key Actions Use the IOCs and detection signatures to identify BRICKSTORM samples. If BRICKSTORM, similar malware, or potentially related activity is detected, report the incident to CISA, Cyber Centre, or required authorities immediately. Indicators of Compromise For a downloadable copy of IOCs associated with this malware, see:  MAR-251165.c1.v1.CLEAR (Dec. 4, 2025) MAR-2512217.c1.v2.CLEAR (Dec. 19, 2025) MAR-261234.c1.v1.CLEAR (Feb. 11, 2026) Detection This Malware Analysis Report includes YARA and Sigma rules. For a downloadable copy of the Sigma rules associated with this malware, see: AR25-338A Sigma YAML. Intended Audience Organizations: Government and critical infrastructure organizations. Roles: Digital forensics analysts, incident responders, vulnerability analysts, system administrators Download the PDF version of this report The referenced media source is missing and needs to be re-embedded. Introduction Note: This Malware Analysis Report was originally published Dec....