ATT&CKReferencesResecurity UNC5221 BRICKSTORM F5 Big-IP October 2025

Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025

Resecurity Threat Intelligence & Incident Analysis. (2025, October 22). F5 BIG-IP Source Code Leak Tied to State-Linked Campaigns Using BRICKSTORM Backdoor. Retrieved April 16, 2026.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software1

BRICKSTORM

Campaigns0

None recorded.

Procedure examples5

TechniqueUsed byProcedure example
T1041
Exfiltration Over C2 Channel		 MalwareBRICKSTORM

BRICKSTORM has uploaded files from the victim system to C2 servers.

CISA BRICKSTORM UNC5221 AR25-338A February 2026CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025Google BRICKSTORM September 2025Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024NVISO BRICKSTORM April 2025Picus Security BRICKSTORM UNC5221 October 2025Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025
T1132.001
Standard Encoding		 MalwareBRICKSTORM

BRICKSTORM has leveraged Base64 to encode C2 communications.

NVISO BRICKSTORM April 2025Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025
T1140
Deobfuscate/Decode Files or Information		 MalwareBRICKSTORM

BRICKSTORM has decoded its encrypted C2 traffic prior to execution. BRICKSTORM also has the ability to decode its obfuscated payload before execution.

CISA BRICKSTORM UNC5221 AR25-338A February 2026CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025Google BRICKSTORM September 2025Picus Security BRICKSTORM UNC5221 October 2025Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025
T1572
Protocol Tunneling		 MalwareBRICKSTORM

BRICKSTORM has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints. BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.

CISA BRICKSTORM UNC5221 AR25-338A February 2026CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025Google BRICKSTORM September 2025Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024NVISO BRICKSTORM April 2025Picus Security BRICKSTORM UNC5221 October 2025Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025
T1573.002
Asymmetric Cryptography		 MalwareBRICKSTORM

BRICKSTORM has communicated with C2 infrastructure via TLS.

CISA BRICKSTORM UNC5221 AR25-338A February 2026CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025Picus Security BRICKSTORM UNC5221 October 2025Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn