BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 Days

BRICKSTORM is a backdoor malware campaign linked to suspected China-nexus threat clusters, active since at least March 2025 and targeting a broad range of United States industries including legal services, SaaS providers, business process outsourcers and technology firms.

According to GTIG, “the value of these targets extends beyond typical espionage missions, potentially providing data to feed development of zero-days and establishing pivot points for broader access to downstream victims.” The campaign is written in Go for cross-platform deployment, enabling stealth on appliances that often lack traditional endpoint detection and response tools.

The malware is highly evasive, and has “enabled them to remain undetected in victim environments for 393 days, on average.” GTIG attributes BRICKSTORM activity to UNC5221, a cluster publicly linked with Silk Typhoon but now assessed as distinct, with techniques such as delayed beaconing, masquerading, cloud-based C2 via Cloudflare Workers, Heroku, sslip[.]io and nip[.]io, and the use of BRICKSTEAL to capture VMware credentials.

The ultimate aims include long-term espionage and IP theft, including attempts to clone domain controller and password vault virtual machines to access databases like ntds[.]dit, thereby facilitating large-scale credential theft.