UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors

UNC5221 is linked to BRICKSTORM, a Go-based backdoor used to infiltrate the U.S. legal services, SaaS and technology sectors, with the aim of maintaining long-term, stealthy access. The malware can pose as a web server, perform file operations, execute shell commands and act as a SOCKS relay, communicating with a C2 server over WebSockets.

Google Threat Intelligence Group (GTIG) and Mandiant Consulting at Google Cloud describe BRICKSTORM as capable of persisting in victim environments for years, noting an average of 393 days of undetected activity and a focus on appliances that lack robust EDR coverage. Initial access has been achieved by exploiting Ivanti Connect Secure edge devices, enabling BRICKSTORM to be dropped on Linux and BSD-based appliances across multiple manufacturers.

The campaign appears to target downstream SaaS customers and seeks information related to national security, international trade and intellectual property to aid future exploits, including zero-days. GTIG and Mandiant also mention BRICKSTORM’s evolution, with modules such as BRICKSTEAL for credential theft and the use of valid credentials for lateral movement within VMware infrastructure. This activity was documented in a Google‑shared report on 24 September 2025.