Chinese APT Drops 'Brickstorm' Backdoors on Edge Devices

A China-linked cyber-espionage group known as UNC5221 is compromising network appliances that cannot run traditional EDR to deploy a new version of the Brickstorm backdoor, targeting organisations across legal services, technology, SaaS providers and BPOs. The campaign uses a cross‑platform Go malware that hides by mimicking legitimate software and employs unique C2 servers per victim, enabling long-term access that GTIG describes as lasting well over a year.

According to Google’s Threat Intelligence Group (GTIG), UNC5221 has been observed quietly accessing developer and administrator emails by abusing Microsoft Entra ID enterprise applications with elevated permissions, and the attackers often pivot from appliances to VMware vCenter and ESXi hosts. Brickstorm is designed to tunnel into internal networks via SOCKS proxy functionality and utilises cloud services like Cloudflare Workers or Heroku, with each victim receiving its own C2 domains to complicate tracking.

The campaign is marked by delayed-start implants, obfuscated Go binaries, and the use of in‑memory filters and credential harvesting techniques, highlighting the growing focus on edge devices and other systems that sit outside conventional monitoring.