Chinese Spies Lurked in Networks for 393 Days, Hunted for Zero-Day Intel

According to Google’s Threat Intelligence Group and Mandiant, researchers analysed a recent BrickStorm campaign linked to UNC5221, a Chinese APT, with the attackers dwelling in compromised networks for hundreds of days to obtain valuable information. The latest campaign, monitored since March 2025, targeted industries including legal services, software-as-a-service (SaaS), technology, and business process outsourcing (BPO).

On average, the cyberspies spent 393 days in the targeted networks, and in at least one case they are believed to have exploited an Ivanti product zero-day vulnerability. BrickStorm has been deployed on various appliances, including Linux- and BSD-based systems, with reports indicating a Windows version as well. The actors consistently targeted VMware vCenter and ESXi hosts, moving laterally to a vCenter server using credentials captured from network appliances.

The researchers note that the intruders aimed to pivot to downstream customers of compromised SaaS providers and to identify zero-day vulnerabilities in enterprise technologies, potentially to exploit across products. Carmakal, CTO of Mandiant Consulting, Google Cloud, emphasised that stolen code could be used to uncover flaws and zero-days in enterprise technology products.