UNC5221 Brickstorm Backdoor WebSocket C2 Binary Subprotocol Upgrade

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

Detects HTTP traffic initiating a WebSocket protocol upgrade with a specific 'binary' subprotocol header, characteristic of the Brickstorm backdoor used by the UNC5221 threat actor for command and control (C2) communication.