Threat intelligence / Malware

BRUSHFIRE

[BRUSHFIRE](https://attack.mitre.org/software/S9011) is a passive backdoor written in C that executes in-memory within an existing process. First reported in March 2025, [BRUSHFIRE](https://attack.mitre.org/software/S9011) has been observed in activity attributed to People's Republic of China (PRC) state-affiliated threat actors, including UNC5221 and SYLVANITE.(Citation: Dragos SYLVANITE MuddyWater Electrum March 2026)(Citation: Google UNC5221 Ivanti April 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BRUSHFIRE](https://attack.mitre.org/software/S9011) is a passive backdoor written in C that executes in-memory within an existing process. First reported in March 2025, [BRUSHFIRE](https://attack.mitre.org/software/S9011) has been observed in activity attributed to People's Republic of China (PRC) state-affiliated threat actors, including UNC5221 and SYLVANITE.(Citation: Dragos SYLVANITE MuddyWater Electrum March 2026)(Citation: Google UNC5221 Ivanti April 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)

Labels

malware

4 recorded

Relationships

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

uses

to Reflective Code Loading

Technique

uses

to Traffic Signaling

Technique

4 external

References

mitre-attack

S9011

Dragos SYLVANITE MuddyWater Electrum March 2026

https://hub.dragos.com/hubfs/2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en

Google UNC5221 Ivanti April 2025

https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability

Picus Security UNC5221 Ivanti May 2025

https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure