BRICKSTORM Espionage Campaign Targets US Networks
Summary
The BRICKSTORM malware, a Go-based backdoor operated by UNC5221 (aka UTA0178, Red Dev 61), has been actively compromising U.S. legal, SaaS, BPO, and technology companies since March 2025. This China-linked espionage campaign exploits Ivanti Connect Secure vulnerabilities (CVE-2023-46805 and CVE-2024-21887) and leverages appliance-based compromises that evade traditional endpoint detection.
The campaign goes beyond typical espionage — it collects intelligence for zero-day discovery, clones VMware domain controller VMs, steals privileged credentials, and compromises cloud mailboxes of high-value personnel such as developers, sysadmins, and executives.
Attack Details
- Initial Access & Deployment:
- Exploits public-facing Ivanti vulnerabilities and, in some cases, unknown infection vectors on Linux/BSD appliances.
- Deploys BRICKSTORM backdoor to maintain persistent, long-term access with average dwell time of 393 days.
- Advanced Tradecraft:
- Uses a malicious Java Servlet filter (BRICKSTEAL) to harvest VMware vCenter credentials.
- Clones virtual machines, particularly domain controllers and password vaults, to escalate privileges and move laterally.
- Removes forensic artifacts to hinder detection and attribution.
- Campaign Objective:
- Stealthily expand foothold across interconnected environments.
- Collect sensitive communications and credentials for strategic Chinese economic and intelligence priorities.
Recommendations
- Implement Network Segmentation & Zero Trust: Micro-segment networks, enforce strict identity verification, and use posture-based access control to prevent lateral movement.
- Harden Management Interfaces: Restrict administrative access, use RBAC, require jump hosts, and disable unnecessary services.
- Review File System Permissions: Audit sensitive directories, disable file sharing where unnecessary, and apply ACLs to enforce least privilege.
- Monitor Non-EDR Appliances: Deploy agentless monitoring, centralize syslogs and network flow data, and enable IDS/IPS with packet capture to detect east-west movement.
MITRE ATT&CK TTPs
- Initial Access: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts)
- Persistence: T1136 (Create Account), T1543 (Create/Modify System Process), T1547 (Boot/Logon Autostart)
- Execution & Defense Evasion: T1059 (Command Interpreter), T1027 (Obfuscated Files), T1505.003 (Web Shell), T1564/006 (Hide Artifacts / Run Virtual Instance)
- Privilege Escalation & Lateral Movement: T1003 (OS Credential Dumping), T1087 (Account Discovery), T1021/004 (SSH), T1021.001 (RDP), T1673 (VM Discovery)
- Collection & Exfiltration: T1114/002 (Remote Email Collection), T1671 (Cloud App Integration), T1041 (Exfiltration Over C2), T1071.004 (DNS), T1567 (Exfiltration over Web Service)
- Command & Control: T1071.001 (Web Protocols)
References
