CISA Releases New Indicators of Compromise Tied to BRICKSTORM Malware

BRICKSTORM is a sophisticated ELF backdoor attributed to PRC state-sponsored actors that targets government services and IT organizations—particularly VMware vSphere environments—providing persistent interactive access, SOCKS proxying, and multi-layer encrypted C2 (HTTPS/WebSockets/nested TLS and DoH). CISA, NSA, and the Canadian Cyber Centre released updated analysis, IOCs (STIX), and detection rules (YARA, Sigma) after incident response work showed active persistence from April 2024 through September 2025 and compromise of domain controllers and ADFS systems.