Exploit / PoCcritical

CISA Reports PRC Hackers Using BRICKSTORM for Long

The Hacker Newsby @TheHackersNewsDec 5, 2025 · 09:15 UTC (Dec 5, 2025)5 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-46805 CVE-2024-21887 CVE-2024-38812 CVE-2023-34048 CVE-2021-22005 CVE-2023-46747

Tags: cve-2023-46805 cve-2024-21887 cve-2024-38812 cve-2023-34048 cve-2021-22005 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-22005	Path Traversal File Upload RCE in VMware vCenter Server (Analytics Service)	9.8	100%	KEVRansomwarePoC	Sep 23, 2021 KEV Nov 3, 2021
CVE-2023-34048	Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server	9.8	99%	KEVPoC	Oct 25, 2023 KEV Jan 22, 2024
CVE-2023-46747	F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE	9.8	97%	KEVRansomwarePoC ×2	Oct 26, 2023 KEV Oct 31, 2023
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1 group max	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024
CVE-2024-38812	Unauthenticated RCE in VMware vCenter Server via DCERPC heap overflow	9.8	55%	KEV	Sep 17, 2024 KEV Nov 20, 2024

From the original article

5 min read at thehackernews.com

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday released details of a backdoor named BRICKSTORM that has been put to use by state-sponsored threat actors from the People's Republic of China (PRC) to maintain long-term persistence on compromised systems.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.