Loading story…
A China-linked cyber-espionage group, tracked as UNC5221, has been systematically targeting network and infrastructure appliances that lack traditional endpoint detection and response (EDR) capabilities. The group has deployed a sophisticated backdoor, known as 'Brickstorm,' to enable persistent, long-term access to compromised environments. According to Google’s Threat Intelligence Group (GTIG), the campaign has affected organizations across various sectors, including legal services, technology, software-as-a-service (SaaS) providers, and business process outsourcing. The attackers have exploited the lack of EDR support on edge devices, making detection and remediation particularly challenging. Brickstorm is designed to evade detection by mimicking legitimate software and using unique command-and-control (C2) servers for each victim, which complicates efforts to block or track the malware. The average dwell time for the attackers within victim networks has been reported as 393 days, indicating a high level of stealth and operational security. During this time, UNC5221 has been observed accessing sensitive emails belonging to developers, administrators, and other individuals of strategic interest, often by abusing Microsoft Entra ID enterprise applications with elevated permissions. The campaign has also resulted in the compromise of SaaS providers, which in turn has led to downstream access to their customers’ environments, amplifying the potential impact. The attackers have targeted leading network appliances from vendors such as SonicWall, Cisco, and Palo Alto Networks, highlighting the breadth of the campaign. GTIG reports that the threat actors have used their access to steal proprietary source code and other intellectual property related to enterprise technologies, which may be analyzed to discover new vulnerabilities for future exploitation. The campaign’s focus on long-term, undetected access distinguishes it from other Chinese-linked espionage operations, such as RedNovember, which prioritizes speed and scale over stealth. Security experts note that the strategic aim of these campaigns is to gain intelligence and maintain persistent access to high-value targets globally. The use of unique C2 infrastructure for each victim further complicates incident response and attribution. The campaign’s ability to remain undetected for over a year in some environments underscores the need for improved monitoring and security controls on edge devices and network appliances. The targeting of organizations with access to downstream customers raises concerns about supply chain risks and the potential for widespread secondary compromise. Researchers emphasize that the attackers’ analysis of stolen source code could lead to the discovery of zero-day vulnerabilities, increasing the threat to enterprise technology products worldwide. The campaign demonstrates the evolving tactics of Chinese APT groups in targeting critical infrastructure and enterprise technologies. Organizations are urged to review their security posture, particularly regarding edge devices and third-party service providers, to mitigate the risk of similar intrusions. The incident highlights the importance of cross-sector collaboration and intelligence sharing to detect and respond to sophisticated, long-term cyber-espionage campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
NSA announced it had joined CISA in releasing guidance on detecting BRICKSTORM backdoor activity. This represents a separate official government response and technical guidance publication related to the campaign.
On September 24, 2025, Recorded Future's Insikt Group published findings on the China-linked RedNovember campaign, also tracked by Microsoft as Storm-2077, which used the Pantegana backdoor and Cobalt Strike to compromise edge devices and high-profile government, defense, and critical infrastructure organizations.
By September 24, 2025, Google Threat Intelligence Group had published research on the Brickstorm campaign, describing a China-linked operation that implanted backdoors on edge devices, maintained access in victim environments for an average of 393 days, and focused on long-term espionage and intellectual property theft.
5 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourceaustinlarsen.me
Open sourcensa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Suspected China-linked threat group UNC5221 has infiltrated numerous U.S. organizations in the legal, technology, SaaS, and business process outsourcing sectors using the BRICKSTORM backdoor. The campaign, uncovered by Google Threat Intelligence and Mandiant, has enabled persistent access for over a year, with attackers remaining undetected for an average of 393 days. BRICKSTORM, a Go-based malware, provides extensive capabilities including web server setup, file manipulation, command execution, and acting as a SOCKS relay, and is often deployed on appliances lacking endpoint detection and response (EDR) support. The attackers have leveraged these intrusions to steal intellectual property, gather intelligence on national security and trade, and potentially develop new zero-day exploits, with evidence suggesting exploitation of edge device vulnerabilities such as those in Ivanti products. The campaign's stealth and focus on high-value targets raise concerns about long-term impacts and the potential for further downstream compromises.
Jun 29, 2026
People’s Republic of China (PRC) state-sponsored cyber actors have been observed deploying the sophisticated BRICKSTORM backdoor malware to maintain long-term, stealthy access within government and information technology sector networks. BRICKSTORM targets both VMware vSphere and Windows environments, employing advanced evasion techniques such as multiple layers of encryption, DNS-over-HTTPS, and a SOCKS proxy for lateral movement. The malware is designed for persistence, with self-monitoring features that allow it to automatically reinstall or restart if disrupted, and has been linked to intrusions where attackers leveraged legitimate credentials and exfiltrated sensitive data from compromised systems. CISA, NSA, and the Canadian Centre for Cyber Security have jointly released detailed analysis and detection guidance for BRICKSTORM, including indicators of compromise (IOCs), YARA and Sigma rules, and technical breakdowns of eight malware samples. Organizations in government and critical infrastructure sectors are urged to use these resources to detect and respond to BRICKSTORM infections, and to report any related activity to authorities. The campaign highlights the evolving capabilities of PRC state-sponsored actors and the need for robust monitoring and incident response in targeted sectors.
Jun 29, 2026
SentinelLABS disrupted multiple China-nexus cyberespionage campaigns between June 2024 and March 2025 targeting SentinelOne, a South Asian government entity, a European media organization, and more than 70 other victims. The ShadowPad and PurpleHaze clusters used chained zero-days in edge appliances, including `CVE-2024-8963` and `CVE-2024-8190`, alongside ShadowPad malware protected by ScatterBrain/ScatterBee obfuscation, the Go-based GOREshell reverse-SSH backdoor, Nimbo-C2, operational relay box networks, and log removal. SentinelOne reported that it was not compromised. A joint Tenable-SentinelOne review shows that this activity reflects a broader cross-actor pattern: 93 CVE-to-actor attribution pairs across 82 vulnerabilities converged on all seven identified edge-device vendors, despite only 21% overlap in the CVEs tracked independently. Twelve flaws have confirmed exploitation by multiple China-, Russia-, DPRK-, or Iran-linked groups and ransomware operators. F5, Citrix, and Ivanti EPMM and Connect Secure deployments face recurring exposure and exploitation; organizations should prioritize edge-device patching, disable unnecessary features, continuously monitor remote-access systems, and use segmentation and other defense-in-depth controls to limit lateral movement after a breach.
Aug 26, 2026