All CISA Advisories, EN

BRICKSTORM Backdoor

Malware Analysis at a Glance
Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. CISA, NSA, and Cyber Centre are releasing this Malware Analysis Report to share indicators of compromise (IOCs) and detection signatures based off analysis of eight BRICKSTORM samples. CISA, NSA, and Cyber Centre urge organizations to use the IOCs and detection signatures to identify BRICKSTORM malware samples.
Key Actions
  • Use the IOCs and detection signatures to identify BRICKSTORM samples.
  • If BRICKSTORM, similar malware, or potentially related activity is detected, report the incident to CISA, Cyber Centre, or required authorities immediately.
Indicators of Compromise For a downloadable copy of IOCs associated with this malware, see: MAR-251165.c1.v1.CLEAR.
Detection

This malware analysis report includes YARA and Sigma rules.

For a downloadable copy of the Sigma rules associated with this malware, see: AR25-338A Sigma YAML.
Intended Audience

Organizations: Government and critical infrastructure organizations.

Roles: Digital forensics analysts, incident responders, vulnerability analysts, This article has been indexed from All CISA Advisories