What is brickstorm-scanner?

The brickstorm-scanner is a security tool from Mandiant that helps you check whether a Linux or BSD system has been infected with a specific backdoor malware called BRICKSTORM. It is meant for situations where you suspect a system may have been compromised and need a quick way to look for signs of this particular threat, especially on appliances or devices that do not have specialized security software installed. At a high level, the scanner is a shell script that examines files on your system and flags any that look like they match a known malware signature. For a file to be flagged, it has to pass three checks: it must be a valid Linux executable (an ELF binary), it must contain a specific set of text strings associated with the malware, and it must contain a particular 25-byte pattern found through a hex dump. Only if all three conditions are met will the tool report a match. You can run it against individual files or point it at an entire directory to scan everything underneath recursively. The people who would use this are IT administrators, security analysts, or anyone responsible for maintaining Linux-based appliances from vendors like VMware or Ivanti. If you have read about the BRICKSTORM espionage campaign and want to check whether your devices are affected, this tool gives you a practical way to do that without needing to install heavier forensic tools. If it finds a match, Mandiant recommends doing a deeper forensic investigation and offers to help directly. What is notable about the project is that it is deliberately built as a simple bash script rather than a more sophisticated tool. This is a deliberate tradeoff: many appliances have minimal software installed and cannot run standard security tools like YARA, so the scanner relies only on utilities that are already present on virtually every Linux system. The project is also upfront about its limitations. It will not catch every variant of the malware, it does not check for other signs of compromise like suspicious processes or logs, and a clean scan does not guarantee the system is safe. It is a focused starting point, not a complete security audit.