UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors
Summary: Mandiant and Google Threat Intelligence Group attributed a campaign to UNC5221 and related suspected China-nexus clusters that targets U.S. legal services, SaaS providers, BPOs, and technology companies to deliver the Go-based BRICKSTORM backdoor. GTIG said the actor's minimal-telemetry lateral movement and data theft, plus modifications to BRICKSTORM, kept it undetected in victim environments for 393 days on average, and that it has responded to several intrusions since March 2025.
What you should know: An average dwell time of 393 days on appliances that do not support EDR means the backdoor can sit on edge devices and VMware infrastructure well past the point where most organizations assume a compromise would have been caught. The stated objective of reaching SaaS providers is downstream customer environments and hosted data, so a single compromised provider extends the exposure to organizations that never see the intrusion themselves.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2023-46805CVE-2024-21887
- Related
- Ivanti Connect Secure VPN Exploitation Goes Global Cyber Risks ·