TRAILBLAZE — Malware Profile

TRAILBLAZE is an in-memory dropper used to deploy the passive backdoor BRUSHFIRE. First reported in March 2025, TRAILBLAZE has been observed in operations attributed to People's Republic of China (PRC) state-sponsored affiliated actors, including UNC5221 and SYLVANITE.

MITRE ATT&CK techniques (4)

• T1055.012 Process Hollowing
• T1057 Process Discovery
• T1070.004 File Deletion
• T1106 Native API

Exploited vulnerabilities

• CVE-2025-22457

Read the full analysis on IntelFusions