NewsPublished 5 Dec 2025

CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems

Source Reddit InfoSec News

Description

CISA has reported that hackers linked to the People's Republic of China (PRC) are using a malware toolset named BRICKSTORM to maintain persistent, long-term access within U. S.government and critical infrastructure systems. This campaign involves stealthy intrusion techniques aimed at espionage and data exfiltration. Although no known exploits are currently in the wild, the threat is considered high severity due to the advanced persistent threat (APT) nature and potential impact on confidentiality and integrity. European organizations with ties to U. S.entities or similar critical infrastructure sectors may also be targeted or affected. Mitigation requires enhanced network monitoring, strict access controls, and threat hunting focused on detecting BRICKSTORM indicators. Countries with significant U.

Impact

For European organizations, especially those with direct or indirect connections to U.S. government agencies, defense contractors, or critical infrastructure sectors, the BRICKSTORM campaign represents a significant risk of espionage and intellectual property theft. Compromise could lead to unauthorized disclosure of sensitive information, disruption of critical services, and erosion of trust in digital systems. The persistent nature of BRICKSTORM means that attackers can maintain footholds for extended periods, increasing the likelihood of extensive data compromise and operational impact. Additionally, European entities involved in transatlantic collaborations or supply chains may become collateral targets or vectors for lateral movement. The geopolitical tensions between PRC and Western countries further elevate the risk of targeted cyber operations against strategically important European nations. The potential impact extends beyond confidentiality to include integrity risks if attackers manipulate data or systems to influence decision-making or operations.

Defensive guidance

European organizations should implement targeted threat hunting for BRICKSTORM indicators, leveraging threat intelligence feeds from CISA and allied cybersecurity agencies. Network segmentation and strict access controls can limit lateral movement opportunities. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying stealthy malware behaviors and anomalous activities. Regularly update and patch systems, focusing on vulnerabilities commonly exploited by APT groups. Enhance monitoring of outbound traffic to detect unusual data exfiltration patterns. Conduct comprehensive user awareness training to reduce the risk of social engineering attacks that may serve as initial infection vectors. Establish incident response plans that include collaboration with national cybersecurity centers and international partners. Sharing intelligence within European cybersecurity communities will improve detection and mitigation capabilities against evolving BRICKSTORM tactics.

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that threat actors associated with the People's Republic of China (PRC) are deploying a sophisticated malware framework called BRICKSTORM to establish and maintain long-term access within targeted U.S. systems. BRICKSTORM is characterized by its stealth capabilities, enabling persistent presence without detection for extended periods. The malware likely facilitates espionage activities, including data collection and exfiltration, targeting sensitive government and critical infrastructure networks. Although specific technical details of BRICKSTORM's components and attack vectors are limited in the current report, the campaign aligns with known APT tactics such as lateral movement, privilege escalation, and evasion techniques. No public exploits have been identified, suggesting the actors rely on custom tools and possibly zero-day vulnerabilities or social engineering for initial access. The threat underscores the ongoing cyber espionage efforts by PRC actors against U.S. interests, with potential spillover risks to allied nations and partners. The minimal discussion and low Reddit engagement indicate early-stage public awareness, but the trusted source and recent timing highlight the importance of vigilance.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Dec 2025, 11:45 UTC

Technical details

References

Community reviews

Related threats