BRICKSTORM Returns: Stealthy Backdoor Campaign Targets Legal, SaaS, and Tech Sectors

Since early 2025, Mandiant and Google Threat Intelligence have been tracking renewed activity from the BRICKSTORM espionage campaign, which now exhibits heightened stealth and persistence across critical industries.

What Is BRICKSTORM and Why It Matters

• The BRICKSTORM backdoor, attributed to a cluster called UNC5221 (or a closely related China-nexus threat actor), is being deployed to maintain long-term, low-visibility access inside targeted environments.

• The targeting is not arbitrary — sectors such as legal services, SaaS providers, business process outsourcing (BPO), and technology firms are specifically in scope.

• These entry points carry strategic value: law firms often possess sensitive geopolitical or trade negotiation information; SaaS firms offer a foothold into customer environments; and tech companies may harbor intellectual property (IP) or research on exploit development.

Campaign Tactics & Lifecycle

The sophistication of BRICKSTORM lies in its ability to circumvent conventional security approaches and persist undetected for extended periods.

1. Initial Access

   • The exact vector is often obscured by the long dwell times, which average around 393 days.

   • In at least one observed case, the actor exploited a zero-day vulnerability in a perimeter / appliance device.

2. Foothold via Appliances

   • The backdoor is written in Go, allowing cross-platform compatibility. It is especially suited to be deployed on devices that don’t support endpoint sensor tools (e.g. network appliances, VPN devices).

   • Evidence shows deployment on Linux and BSD appliances, and frequent targeting of VMware vCenter or ESXi hosts.

   • The actor may laterally pivot from appliances into internal infrastructure, using captured credentials.

3. Privilege Elevation & Credential Capture

   • A notable technique is the use of a stealthy servlet filter (dubbed BRICKSTEAL) on vCenter’s Tomcat component. This filter intercepts HTTP Basic auth headers from login attempts and captures credentials — all without restarting services or leaving persistent artifacts.

   • From vCenter, the actor can clone VMs (including domain controllers or vaults), mount their disks offline, and harvest sensitive data — all while avoiding execution of endpoint security tools.

4. Lateral Movement & Exfiltration

   • Multiple compromised appliance nodes may act as backups, and the primary node can enable lateral access to Windows systems.

   • The backdoor supports SOCKS proxying, enabling tunneling of attacker workstations into the internal network for selective reconnaissance or exfiltration.

   • In many incidents, attackers accessed Microsoft 365 mailboxes by abusing enterprise applications with broad mail.read or full_access_as_app permissions.

5. Persistence & Anti-Detection Measures

   • The actor uses subtle modifications to startup scripts (e.g. rc.local, systemd, init.d) or may embed web shells (e.g. SLAYSTYLE, tracked as BEEFLUSH) for backdoor access.

   • The backdoor’s naming and behavior often masquerade as legitimate processes, and each victim has shown distinct command & control (C2) infrastructure (i.e. no reuse).

   • Some samples carry delay timers or obfuscation layers (e.g. Garble), enabling the actor to modulate behavior over time.

Detection & Hunting Guidance

Given the high operational security (OPSEC) and lack of reuse of indicators (IOCs), organizations must emphasize behavior (TTP) over static signatures.

A baseline hunting checklist includes:

• Maintain a comprehensive asset inventory that includes appliances and network devices not covered by endpoint security tools.

• Scan file systems and backup stores for BRICKSTORM binaries using YARA rules (or Mandiant’s new scanner script).

• Monitor outbound traffic from management interfaces of appliances — legitimate communications should be tightly controlled and limited to vendor endpoints.

• Detect anomalous logins from appliances into Windows systems (via network logins) and parse the Windows User Access Log (UAL) to identify cross-IP sessions.

• Audit vCenter server logs (VPXD) for cloning or unconventional VM activity during off hours.

• Monitor for the creation and deletion of local accounts on vCenter / ESXi hosts, and for enabling SSH on virtualization platforms.

• Enumerate Microsoft Entra / Azure AD enterprise applications that have mail access scopes, and cross-reference mailItemsAccessed logs for irregular behavior.

Hardening Recommendations

• Apply the principle of least privilege to appliances — restrict their network access (both internal and external) to only what is strictly necessary. Centralize logging from appliances and forward to your SIEM or monitoring infrastructure.

• Enable vSphere lockdown mode, enable multi‐factor authentication (MFA) on vCenter logins, and enforce secure policies (e.g. execInstalledOnly).

• Isolate credential vaulting systems and treat them as Tier-0 assets (i.e. limit OS access, network exposure).

• Encourage vendors to adopt robust security practices, such as storing encryption keys in TPMs and enabling secure boot or firmware validation where possible.

Strategic Impact & Outlook

BRICKSTORM’s resurgence underscores the evolving challenges in defending environments where traditional endpoint security cannot reach — particularly appliances, virtualization layers, and vendor-managed systems.

For large organizations and supply chains, the targeting of SaaS and legal sectors suggests an intent to weaponize data access and downstream pivots.

The emphasis now must shift from chasing static IOCs to designing detection systems with threat actor behaviors in mind, building asset awareness across all layers, and hardening infrastructure that historically enjoyed less scrutiny.