How Chinese Hackers Used BRICKSTORM Malware to Breach US Tech and Law Firms

In the escalating arena of cyber espionage, state-backed actors from China have deployed advanced tools to target American entities. The BRICKSTORM backdoor, wielded by the group UNC5221, has enabled prolonged intrusions into US technology companies, law firms, SaaS providers, and business process outsourcers. Revealed in a September 24, 2025, report by Google's Mandiant and Threat Intelligence Group, this campaign has maintained access for an average of 393 days, allowing hackers to exfiltrate intellectual property, executive emails, and source code. This operation underscores Beijing's strategic push to acquire sensitive data amid US-China trade tensions, focusing on sectors vital to economic and national security.

UNC5221: The Shadowy Force Behind BRICKSTORM

UNC5221, a China-nexus threat actor, has been active in espionage operations aligned with Beijing's interests in technology dominance. Tracked since early 2025, this group distinguishes itself through stealth and adaptability, avoiding overlaps with other known Chinese actors like Volt Typhoon. Their tactics support China's goals in semiconductors, AI, and cloud services by stealing proprietary information.

UNC5221 excels in operational security, rarely reusing infrastructure or malware samples, which hampers detection via traditional indicators. Initial reports from April 2025 linked them to Ivanti VPN zero-day exploits, but recent findings show expanded use of BRICKSTORM for persistent access. Mandiant's Charles Carmakal highlighted the campaign's sophistication in evading enterprise defenses and targeting high-value assets.

Investigations since March 2025 reveal intrusions where dwell times exceed log retention, complicating forensics. Hackers monitor responses in real time, deploying updated variants to reestablish footholds. This agility marks UNC5221 as a formidable adversary in state-sponsored cyber operations.

Decoding BRICKSTORM: Technical Breakdown

BRICKSTORM is a custom Go-based backdoor designed for cross-platform deployment on Linux, BSD, and occasionally Windows systems. It masquerades as legitimate processes, with stripped symbols and obfuscated strings to resist analysis. Installed via SSH with compromised credentials, it creates SOCKS proxies for internal network access, enabling data theft without direct interaction.

The malware's modular architecture allows dynamic loading of components, facilitating tasks like file transfers and command execution. It communicates with command-and-control servers using encrypted channels, blending in with normal traffic to avoid detection. Its persistence mechanisms include cron jobs and systemd services, ensuring survival through reboots.

Advanced Features and Detection Evasion

BRICKSTORM resolves C2 servers using DNS over HTTPS, evading DNS monitoring. Traffic routes through serverless platforms like Cloudflare Workers, mimicking benign activity. It employs multi-layered encryption: outer HTTPS upgrades to WebSockets, followed by nested TLS sessions for commands. This setup thwarts network inspections.

Persistence involves altering startup scripts, deploying web shells, or in-memory loading. Some variants include delay timers, activating months later. Windows versions focus on tunneling RDP and SMB with valid credentials for lateral movement.

Data exfiltration uses HTTP APIs in JSON, supporting TCP, UDP, and ICMP protocols. Targets include Microsoft Entra ID for emails and UNC paths for files. Deployment prioritizes EDR-exempt devices like VMware vCenter, ESXi, email gateways, and scanners. In one instance, hackers pivoted from a network appliance to vCenter using stolen credentials.

Early 2025 analyses by NVISO noted European targets, but September updates confirm US focus with ongoing evolution. Custom builds per victim bypass signatures, necessitating behavior-based detection.

The Intrusion Playbook: Step-by-Step Tactics

UNC5221's methodology is systematic. Initial entry often exploits zero-days in edge devices, such as Ivanti Connect Secure vulnerabilities (CVE-2023-46805, CVE-2024-21887). Post-compromise, they enumerate appliances via SSH, add temporary accounts, and implant BRICKSTORM.

Lateral movement leverages SOCKS proxies for low-visibility pivots to workstations and repositories, downloading data as ZIPs. They scrub logs, delete artifacts, and maintain multiple backdoors. Delayed variants activate after remediation.

Supply chain exploitation is central: breaching SaaS or BPOs grants access to clients. GTIG's John Hultquist described it as a long-game for intelligence and exploit crafting.

Victims and Repercussions: Damage Assessment

Law firms are prime targets for M&A intelligence, litigation details, and client secrets. Email theft via Entra ID risks exposing security-sensitive cases. Tech companies lose source code, aiding Chinese reverse-engineering.

SaaS and BPO breaches cascade to downstream entities, including major corporations. Prolonged access enables massive data theft, supporting China's industrial plans like Made in China 2025. Reports indicate hits on cloud providers critical to US businesses.

Impacts include billions in IP losses, diminished trust, and M&A vulnerabilities. Geopolitically, it provides Beijing negotiation leverage.

Future Outlook: Staying Ahead in Cyber Defense

BRICKSTORM transforms overlooked appliances into espionage gateways, highlighting needs for comprehensive security. As UNC5221 adapts, US organizations must emphasize proactive hunting and resilience. This campaign foreshadows intensified cyber conflicts. Vigilance, rapid patching, and behavioral monitoring are essential.