BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

The article discusses the BRICKSTORM backdoor, a persistent and stealthy cyber threat targeting U.S. technology and legal firms. Tracked by Google Threat Intelligence Group and investigated by Mandiant, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, exploiting vulnerabilities in network appliances. The backdoor, which operates on Linux and BSD devices, allows attackers to harvest sensitive data and clone critical virtual machines.

Mandiant has released a BRICKSTORM scanner to help organizations detect infections and recommends reevaluating asset inventories and monitoring network logs for suspicious activity. The article emphasizes the need for TTP-based defenses to counter this sophisticated threat.