BRICKSTORM Malware Quietly Builds the Perfect Hideout in US Networks

BRICKSTORM Espionage Campaign Targets US Networks

Summary

The BRICKSTORM malware, a Go-based backdoor operated by UNC5221 (aka UTA0178, Red Dev 61), has been actively compromising U.S. legal, SaaS, BPO, and technology companies since March 2025. This China-linked espionage campaign exploits Ivanti Connect Secure vulnerabilities (CVE-2023-46805 and CVE-2024-21887) and leverages appliance-based compromises that evade traditional endpoint detection.

The campaign goes beyond typical espionage — it collects intelligence for zero-day discovery, clones VMware domain controller VMs, steals privileged credentials, and compromises cloud mailboxes of high-value personnel such as developers, sysadmins, and executives.

Attack Details

• Initial Access & Deployment:

  • Exploits public-facing Ivanti vulnerabilities and, in some cases, unknown infection vectors on Linux/BSD appliances.

  • Deploys BRICKSTORM backdoor to maintain persistent, long-term access with average dwell time of 393 days.

• Advanced Tradecraft:

  • Uses a malicious Java Servlet filter (BRICKSTEAL) to harvest VMware vCenter credentials.

  • Clones virtual machines, particularly domain controllers and password vaults, to escalate privileges and move laterally.

  • Removes forensic artifacts to hinder detection and attribution.

• Campaign Objective:

  • Stealthily expand foothold across interconnected environments.

  • Collect sensitive communications and credentials for strategic Chinese economic and intelligence priorities.

Recommendations

• Implement Network Segmentation & Zero Trust: Micro-segment networks, enforce strict identity verification, and use posture-based access control to prevent lateral movement.

• Harden Management Interfaces: Restrict administrative access, use RBAC, require jump hosts, and disable unnecessary services.

• Review File System Permissions: Audit sensitive directories, disable file sharing where unnecessary, and apply ACLs to enforce least privilege.

• Monitor Non-EDR Appliances: Deploy agentless monitoring, centralize syslogs and network flow data, and enable IDS/IPS with packet capture to detect east-west movement.

MITRE ATT&CK TTPs

• Initial Access: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts)

• Persistence: T1136 (Create Account), T1543 (Create/Modify System Process), T1547 (Boot/Logon Autostart)

• Execution & Defense Evasion: T1059 (Command Interpreter), T1027 (Obfuscated Files), T1505.003 (Web Shell), T1564/006 (Hide Artifacts / Run Virtual Instance)

• Privilege Escalation & Lateral Movement: T1003 (OS Credential Dumping), T1087 (Account Discovery), T1021/004 (SSH), T1021.001 (RDP), T1673 (VM Discovery)

• Collection & Exfiltration: T1114/002 (Remote Email Collection), T1671 (Cloud App Integration), T1041 (Exfiltration Over C2), T1071.004 (DNS), T1567 (Exfiltration over Web Service)

• Command & Control: T1071.001 (Web Protocols)

References

• Google Threat Intel – BRICKSTORM Espionage Campaign

• HivePro – Ivanti Zero-Day Flaws Advisory

• HivePro – CVE-2025-22457 Actively Exploited

• HivePro – SAP NetWeaver CVE-2025-31324 Advisory

• MITRE ATT&CK Techniques