← Back to Feed
BRICKSTORM Backdoor
December 3, 2025 · CISA Advisories · Severity: HIGH
CISA published a malware analysis report on BRICKSTORM, a backdoor that provides persistent remote access to compromised Windows systems. It features encrypted C2 communications and file exfiltration capabilities. The report provides behavioral detection guidance and IOCs for network defenders.
Key Takeaways
- CISA MAR analysis reveals BRICKSTORM backdoor providing persistent remote access to compromised Windows systems.
- BRICKSTORM uses encrypted command and control communications and file exfiltration capabilities to steal sensitive data.
- Defenders should deploy detection rules for BRICKSTORM based on the behavioral indicators provided in the report.