Google warns of Brickstorm backdoor targeting U.S. legal and tech sectors

Google Threat Intelligence Group observed the Go-based BRICKSTORM backdoor being used to maintain persistence in U.S. organisations since March 2025, with targets including legal firms, SaaS providers, BPOs, and Technology firms, according to Google Threat Intelligence Group. Mandiant linked the activity to China-nexus APT UNC5221, a group known for exploiting zero-days for espionage and broader access.

BRICKSTORM can function as a web server, manipulate the file system, upload/download files, execute shell commands, and relay traffic via SOCKS proxies, using WebSockets for command-and-control communications, and it has been seen on Linux and BSD appliances with stealthy features such as delayed beaconing and rotating C2 domains through Cloudflare, Heroku and dynamic DNS.

In a newer wave, attackers deployed a stealthy in-memory Java Servlet filter tracked as BRICKSTEAL on vCenter to intercept HTTP Basic authentication and steal high-privilege credentials, enabling lateral movement to systems like Delinea Secret Server. The operation aims to exfiltrate emails via Entra ID apps, leveraging mail[.]read or full_access_as_app scopes to access mailboxes, with some targets including developers and system administrators aligned with PRC economic and espionage interests.