CISA Issues 2025 Update: New Detection for BRICKSTORM Backdoor Malware
In December 2025, CISA, the NSA, and the Canadian Centre for Cyber Security released an updated malware analysis report on the BRICKSTORM backdoor. The update detailed new Rust-based variants featuring advanced persistence, evasive execution as background services, and robust command and control via encrypted WebSocket connections. Organizations were provided with new YARA detection signatures and IOCs to bolster defenses and urged to scan for, report, and contain potential infections. This surge in sophisticated malware highlights evolving attacker tactics aimed at stealthy, persistent network infiltration. The growing adoption of advanced persistent threats such as BRICKSTORM underlines the critical need for proactive threat detection, zero trust segmentation, and cyber hygiene. Security teams must stay vigilant as attackers refine malware with encrypted communications and evasion strategies, while regulatory bodies continue to emphasize robust incident response.
Kill Chain
