Loading story…
Suspected China-linked threat group UNC5221 has infiltrated numerous U.S. organizations in the legal, technology, SaaS, and business process outsourcing sectors using the BRICKSTORM backdoor. The campaign, uncovered by Google Threat Intelligence and Mandiant, has enabled persistent access for over a year, with attackers remaining undetected for an average of 393 days. BRICKSTORM, a Go-based malware, provides extensive capabilities including web server setup, file manipulation, command execution, and acting as a SOCKS relay, and is often deployed on appliances lacking endpoint detection and response (EDR) support. The attackers have leveraged these intrusions to steal intellectual property, gather intelligence on national security and trade, and potentially develop new zero-day exploits, with evidence suggesting exploitation of edge device vulnerabilities such as those in Ivanti products. The campaign's stealth and focus on high-value targets raise concerns about long-term impacts and the potential for further downstream compromises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
CISA released a Malware Analysis Report for the BRICKSTORM backdoor, providing official U.S. government technical analysis of the malware. The report added authoritative technical details and indicators to support defender detection and response for BRICKSTORM activity.
Alongside the public disclosure, Mandiant released a free scanner script for Linux/BSD appliances based on BRICKSTORM YARA logic and shared YARA rules for related malware. The company warned the tooling was not comprehensive and would not assess persistence mechanisms or whether devices remained vulnerable.
On September 24, 2025, Google and Mandiant publicly disclosed the BRICKSTORM espionage campaign and attributed it to the China-linked UNC5221 cluster. They described use of stealthy command-and-control traffic masquerading as services such as Cloudflare and Heroku, along with post-compromise tools including Bricksteal and Slaystyle.
Mandiant and Google reported that BRICKSTORM intrusions often remained undetected for over a year, with an average dwell time of 393 days. The malware was observed on Linux/BSD appliances and VMware vCenter/ESXi systems that typically lack EDR coverage, helping the actor evade enterprise defenses.
On 2025-09-22, Mandiant published a standalone Bash-based BRICKSTORM IOC scanner for Linux and BSD systems on GitHub. The tool replicated logic from the G_APT_Backdoor_BRICKSTORM_3 YARA rule as a best-effort detector and warned it would not detect all variants or assess persistence or vulnerability status.
Since at least March 2025, Mandiant said it had responded to numerous UNC5221 intrusions affecting U.S. law firms, SaaS providers, and technology companies. The campaign focused on stealing intellectual property and accessing senior leaders' email inboxes while maintaining persistence in poorly monitored edge and virtualization environments.
Investigators determined that at least one of the BRICKSTORM-linked compromises involved exploitation of a zero-day vulnerability in Ivanti Connect Secure. Mandiant assessed edge-device zero-day exploitation as a likely initial access method more broadly, although long dwell times and missing logs limited confirmation in many cases.
Google Threat Intelligence Group said it documented the Go-based BRICKSTORM backdoor in April 2024 after observing China-related intrusions that appeared to originate from edge devices. The malware was designed for stealthy long-term access, data theft, file operations, payload delivery, SOCKS relaying, and remote command execution.
14 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcehackread.com
Open sourcego.theregister.com
Open sourcegovinfosecurity.com
Open sourcegithub.com
Open sourcenviso.eu
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-linked cyber-espionage group, tracked as UNC5221, has been systematically targeting network and infrastructure appliances that lack traditional endpoint detection and response (EDR) capabilities. The group has deployed a sophisticated backdoor, known as 'Brickstorm,' to enable persistent, long-term access to compromised environments. According to Google’s Threat Intelligence Group (GTIG), the campaign has affected organizations across various sectors, including legal services, technology, software-as-a-service (SaaS) providers, and business process outsourcing. The attackers have exploited the lack of EDR support on edge devices, making detection and remediation particularly challenging. Brickstorm is designed to evade detection by mimicking legitimate software and using unique command-and-control (C2) servers for each victim, which complicates efforts to block or track the malware. The average dwell time for the attackers within victim networks has been reported as 393 days, indicating a high level of stealth and operational security. During this time, UNC5221 has been observed accessing sensitive emails belonging to developers, administrators, and other individuals of strategic interest, often by abusing Microsoft Entra ID enterprise applications with elevated permissions. The campaign has also resulted in the compromise of SaaS providers, which in turn has led to downstream access to their customers’ environments, amplifying the potential impact. The attackers have targeted leading network appliances from vendors such as SonicWall, Cisco, and Palo Alto Networks, highlighting the breadth of the campaign. GTIG reports that the threat actors have used their access to steal proprietary source code and other intellectual property related to enterprise technologies, which may be analyzed to discover new vulnerabilities for future exploitation. The campaign’s focus on long-term, undetected access distinguishes it from other Chinese-linked espionage operations, such as RedNovember, which prioritizes speed and scale over stealth. Security experts note that the strategic aim of these campaigns is to gain intelligence and maintain persistent access to high-value targets globally. The use of unique C2 infrastructure for each victim further complicates incident response and attribution. The campaign’s ability to remain undetected for over a year in some environments underscores the need for improved monitoring and security controls on edge devices and network appliances. The targeting of organizations with access to downstream customers raises concerns about supply chain risks and the potential for widespread secondary compromise. Researchers emphasize that the attackers’ analysis of stolen source code could lead to the discovery of zero-day vulnerabilities, increasing the threat to enterprise technology products worldwide. The campaign demonstrates the evolving tactics of Chinese APT groups in targeting critical infrastructure and enterprise technologies. Organizations are urged to review their security posture, particularly regarding edge devices and third-party service providers, to mitigate the risk of similar intrusions. The incident highlights the importance of cross-sector collaboration and intelligence sharing to detect and respond to sophisticated, long-term cyber-espionage campaigns.
Jun 29, 2026
People’s Republic of China (PRC) state-sponsored cyber actors have been observed deploying the sophisticated BRICKSTORM backdoor malware to maintain long-term, stealthy access within government and information technology sector networks. BRICKSTORM targets both VMware vSphere and Windows environments, employing advanced evasion techniques such as multiple layers of encryption, DNS-over-HTTPS, and a SOCKS proxy for lateral movement. The malware is designed for persistence, with self-monitoring features that allow it to automatically reinstall or restart if disrupted, and has been linked to intrusions where attackers leveraged legitimate credentials and exfiltrated sensitive data from compromised systems. CISA, NSA, and the Canadian Centre for Cyber Security have jointly released detailed analysis and detection guidance for BRICKSTORM, including indicators of compromise (IOCs), YARA and Sigma rules, and technical breakdowns of eight malware samples. Organizations in government and critical infrastructure sectors are urged to use these resources to detect and respond to BRICKSTORM infections, and to report any related activity to authorities. The campaign highlights the evolving capabilities of PRC state-sponsored actors and the need for robust monitoring and incident response in targeted sectors.
Jun 29, 2026
F5 disclosed that a state-sponsored intruder maintained long-term access to its environment and stole sensitive data including **BIG-IP source code**, details of reported but not yet patched or disclosed vulnerabilities, and configuration and implementation information for a limited number of customers. Reporting attributed the intrusion to the China-linked group **UNC5221**, which allegedly used the **BRICKSTORM** backdoor and remained in the environment for more than 12 months. F5 said the incident did **not** involve a supply-chain compromise and did not affect CRM, financial systems, customer support, iHealth, or systems tied to other product lines. Mandiant separately published hunting guidance describing BRICKSTORM as a stealthy espionage backdoor deployed on edge devices and appliances, with operators pivoting into enterprise environments through suspicious outbound traffic, appliance management interfaces, Windows **Type 3** logons, occasional **RDP**, Microsoft 365 mail access abuse, and VMware vCenter or ESXi account manipulation. Defenders were urged to scan appliance files and backups with **YARA** and a Linux/BSD appliance scanner, review logs for rare **DNS-over-HTTPS** activity, inspect Windows User Access Logs, and check vCenter audit trails for temporary local accounts used to install BRICKSTORM. F5 said it rotated cryptographic material and released updates for **BIG-IP**, **F5OS**, **BIG-IP Next for Kubernetes**, **BIG-IQ**, and **APM clients** to address 44 vulnerabilities, including the leaked issues.
Aug 14, 2026