CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems
Summary: CISA released details of BRICKSTORM, a Golang backdoor used by PRC state-sponsored actors to maintain long-term persistence on VMware vSphere and Windows systems, supporting HTTPS, WebSockets, nested TLS, DNS-over-HTTPS for command-and-control, and SOCKS proxy capabilities for lateral movement. The malware, first documented by Google Mandiant in 2024 in attacks exploiting Ivanti Connect Secure zero-days CVE-2023-46805 and CVE-2024-21887, has been attributed to clusters tracked as UNC5221 and Warp Panda, and includes a self-monitoring function that reinstalls or restarts it after disruption.
What you should know: CISA did not disclose how many government agencies were impacted or what data was stolen, and in one April 2024 case the initial access vector and web shell deployment timing remain unknown - meaning the entry point into at least one network is still unexplained.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-46805CVE-2024-21887
- Related
- Ivanti Connect Secure VPN Exploitation: New Observations Cyber Risks ·