BRICKSTORM

{
  "id": "ATTACK:enterprise:S9015",
  "title": "BRICKSTORM",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9015",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--0450ed20-e9a7-4799-b601-2f2710300796",
  "external_id": "S9015",
  "domain": "enterprise",
  "created": "2026-04-16T17:34:09.075Z",
  "modified": "2026-04-23T03:13:35.645Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
      "url": "https://blog.cloudflare.com/2026-threat-report/"
    },
    {
      "source_name": "CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025",
      "url": "https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"
    },
    {
      "source_name": "CISA BRICKSTORM UNC5221 AR25-338A February 2026",
      "url": "https://www.cisa.gov/news-events/analysis-reports/ar25-338a"
    },
    {
      "source_name": "Dragos SYLVANITE MuddyWater Electrum March 2026",
      "url": "https://hub.dragos.com/hubfs/2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en"
    },
    {
      "source_name": "Picus Security BRICKSTORM UNC5221 October 2025",
      "url": "https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"
    },
    {
      "source_name": "Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
    },
    {
      "source_name": "NVISO BRICKSTORM April 2025",
      "url": "https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"
    },
    {
      "source_name": "Google BRICKSTORM GRIMBOLT UNC5221 UNC6201 February 2026",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day"
    },
    {
      "source_name": "Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025",
      "url": "https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor"
    },
    {
      "source_name": "Google BRICKSTORM September 2025",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
    }
  ]
}