S9012 TRAILBLAZE

malwareEnterprise

platformsLinux · Network Devices

also known asTRAILBLAZE

TRAILBLAZE is an in-memory dropper used to deploy the passive backdoor BRUSHFIRE. First reported in March 2025, TRAILBLAZE has been observed in operations attributed to People's Republic of China (PRC) state-sponsored affiliated actors, including UNC5221 and SYLVANITE.

techniques used (4)

ATT&CK techniques this enables or maps to.

T1055.012Process Hollowing
T1057Process Discovery
T1070.004File Deletion
T1106Native API

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan