S9011 BRUSHFIRE

malwareEnterprise

platformsLinux · Network Devices

also known asBRUSHFIRE

BRUSHFIRE is a passive backdoor written in C that executes in-memory within an existing process. First reported in March 2025, BRUSHFIRE has been observed in activity attributed to People's Republic of China (PRC) state-affiliated threat actors, including UNC5221 and SYLVANITE.

techniques used (4)

ATT&CK techniques this enables or maps to.

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1140Deobfuscate/Decode Files or Information
T1205Traffic Signaling
T1620Reflective Code Loading

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan