UNC5221 Cyberespionage Campaign Using BRICKSTORM Backdoor Against U.S. Legal and Technology Sectors

Suspected China-linked threat group UNC5221 has infiltrated numerous U.S. organizations in the legal, technology, SaaS, and business process outsourcing sectors using the BRICKSTORM backdoor. The campaign, uncovered by Google Threat Intelligence and Mandiant, has enabled persistent access for over a year, with attackers remaining undetected for an average of 393 days. BRICKSTORM, a Go-based malware, provides extensive capabilities including web server setup, file manipulation, command execution, and acting as a SOCKS relay, and is often deployed on appliances lacking endpoint detection and response (EDR) support. The attackers have leveraged these intrusions to steal intellectual property, gather intelligence on national security and trade, and potentially develop new zero-day exploits, with evidence suggesting exploitation of edge device vulnerabilities such as those in Ivanti products. The campaign's stealth and focus on high-value targets raise concerns about long-term impacts and the potential for further downstream compromises.