BRICKSTORM persistence on edge devices
Attackers deploy in-memory backdoors on network appliances to maintain access that can survive ordinary endpoint remediation.
- Momentum score
- 67
- Impact
- High
- Confidence
- High
What it is
BRICKSTORM is a backdoor used for cyber-espionage persistence on network appliances and virtualization infrastructure, where traditional endpoint agents often have limited visibility. By residing on infrastructure rather than an employee workstation, it can preserve access even after ordinary endpoint remediation. Mandiant's investigations connected the malware to a broader pattern of long-dwell intrusions and exploitation of edge-device weaknesses highlighted in M-Trends 2026.
Why it is rising
M-Trends 2026 highlighted edge-device zero-days and deep persistence as recurring frontline incident-response themes.
Six-month trajectory
Normalized weekly momentum for prototype validation
+11 over 4 weeks
Marketing implications
High-level suggestions for buyer education. These are not claims that a product would have prevented a reported incident.
- 01Challenge endpoint-only assumptions by showing where attackers persist outside workstations.
- 02Connect appliance telemetry with complete incident scoping and durable remediation.
- 03Create architecture content for monitoring edge systems with limited agents.