Chinese-linked hackers have successfully infiltrated U.S. technology and legal organizations using sophisticated malware called Brickstorm, maintaining undetected access for over a year on average, according to a new report from Google’s Threat Intelligence Group.
## The Brickstorm Threat
Brickstorm is a Go-based backdoor malware that functions as a multi-purpose cyber weapon, serving as a web server, file manipulation tool, data dropper, SOCKS relay, and command execution platform. Google researchers discovered that attackers remained hidden in victim networks for an average of 393 days before detection.
The malware specifically targets organizations in the technology and legal sectors, including software-as-a-service (SaaS) providers and Business Process Outsourcers (BPOs). These strategic targets allow hackers to potentially develop zero-day exploits and launch secondary attacks against downstream victims, particularly those lacking advanced endpoint detection systems.
## Attribution and Attack Methods
Google attributes these attacks to UNC5221, a threat group known for exploiting Ivanti zero-day vulnerabilities to target government agencies with custom malware tools like Spawnant and Zipline.
The attackers deploy Brickstorm on network appliances that don’t support endpoint detection and response (EDR) solutions, including VMware vCenter and ESXi systems. The malware disguises its communications with command-and-control servers as legitimate traffic from services like Cloudflare and Heroku.
## Attack Progression
Once established, the hackers escalate privileges using a malicious Java component called Bricksteal on vCenter systems to capture credentials. They also clone Windows Server virtual machines to extract sensitive information. These stolen credentials enable lateral movement throughout the network and establish persistent access by enabling SSH on ESXi systems and modifying startup scripts.
The primary goal is data exfiltration, particularly emails accessed through Microsoft Entra ID Enterprise Apps. The malware uses SOCKS proxy capabilities to tunnel into internal systems and code repositories while maintaining stealth.
## Targets and Cleanup
Google’s analysis reveals that UNC5221 specifically focuses on developers, administrators, and individuals connected to China’s economic and security interests. After completing operations, the attackers remove the malware to complicate forensic investigations. They never reuse command-and-control domains or malware samples, making detection and attribution more challenging.
## Defense Measures
To assist cybersecurity professionals, Mandiant has released a free scanner script that includes YARA rules for detecting Brickstorm variants on Linux and BSD systems. However, the company warns that the scanner may not detect all variants and doesn’t guarantee complete compromise detection or identify all persistence mechanisms.
This campaign highlights the sophisticated nature of state-sponsored cyber espionage and the critical need for organizations to implement comprehensive security measures, particularly for edge devices and network appliances that may lack traditional endpoint protection.