BRICKSTORM is a stealthy, cross-platform backdoor written in Go, used by the suspected China-nexus cluster UNC5221 for long-dwell cyber-espionage against US organisations. It is purpose-built for network edge appliances and virtualisation infrastructure — Linux and BSD-based appliances, VMware vCenter and ESXi — that typically lack EDR coverage, letting operators persist for very long periods while stealing email and intellectual property. Google’s Threat Intelligence Group and Mandiant detailed the campaign on 24 September 2025, reporting an average dwell time of 393 days.
Overview & Attribution
BRICKSTORM is attributed to UNC5221 and closely related suspected China-nexus clusters, assessed as geopolitical espionage with objectives spanning access operations, intellectual-property theft and support for future zero-day development. UNC5221 has been tied in prior reporting to Ivanti Connect Secure zero-day exploitation; note that Google does not treat UNC5221 and “Silk Typhoon” as the same cluster. Companion tooling in the same intrusions includes the BRICKSTEAL credential-stealing servlet and the SLAYSTYLE web shell.
BRICKSTORM runs on appliances and hypervisors that rarely carry endpoint detection. No C2 domain reuse was seen across victims, so indicator-based detection is of limited value — Mandiant recommends TTP-based hunting instead.
Capabilities
- Runs as a web server; file upload, download and operations; shell command execution; and a SOCKS-proxy relay to pivot into internal networks. T1090 T1059
- C2 over DNS-over-HTTPS in some cases, using cloud and CDN fronting such as Cloudflare Workers, Heroku apps and wildcard-DNS services. T1071.001
- Evasion: obfuscation with Garble, appliance-appropriate naming to blend in, and a sample with a built-in delay timer that waited for a future date before beaconing. T1027
Intrusion Lifecycle
- Initial access focused on perimeter and remote-access infrastructure; in most cases the entry vector was not confirmed, and at least one case used a zero-day. T1190 T1133
- Credential capture via the BRICKSTEAL servlet injected into Apache Tomcat on vCenter to capture authentication, plus cloning domain-controller VMs to extract
ntds.dit. T1003.003 - Lateral movement with valid credentials over SSH, enabling SSH via the ESXi or vCenter interface, and creating temporary local accounts. T1021.004 T1136.001
- Objectives: created Enterprise Applications in Microsoft Entra ID with mail-read scopes for bulk M365 mailbox access, and tunnelled into internal web apps and code repositories. T1114
- Anti-forensics via log and trace cleanup; BRICKSTORM sometimes removed from live systems but later found in backup images. T1070
MITRE ATT&CK Mapping
Web Protocols C2 is cited in Mandiant’s detection rules; the remaining techniques are analyst-mapped from the reported behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Command and Control | T1071.001 Web Protocols | DoH and CDN-fronted C2 |
| Command and Control | T1090 Proxy | SOCKS relay into internal networks |
| Initial Access | T1190 Exploit Public-Facing Application | Zero-day in at least one case |
| Credential Access | T1003.003 NTDS | DC clone to extract ntds.dit |
| Lateral Movement | T1021.004 SSH | Valid-credential movement |
| Collection | T1114 Email Collection | Entra app bulk mailbox access |
Detection & Mitigation
- Use Mandiant’s released BRICKSTORM scanner on appliances, and hunt by TTP rather than indicators: DoH to unknown endpoints from appliances, edge devices reaching into Windows or Active Directory, and traffic to Cloudflare Workers, Heroku or wildcard-DNS services.
- Watch vCenter Tomcat for unexpected in-memory servlet filters on SSO paths, SSH newly enabled via the ESXi or vCenter interface, new local accounts, and VM-cloning events in hypervisor logs.
- Review Entra ID for new Enterprise Applications granted mail-read scopes; harden vSphere with central logging, lockdown mode and MFA; treat credential-vault servers as Tier 0; scan backup images.
Hunt Below the EDR Line
Mjolnir Security helps organisations find long-dwell backdoors on the appliances and hypervisors that endpoint tools cannot see.
- Compromise Assessment TTP-based hunting across appliances, vCenter/ESXi and identity for long-dwell espionage backdoors.
- Threat Hunting as a Service Hunting for appliance-originated DoH, SOCKS relaying and Entra app abuse.
- 24/7 Incident Response Containment and eradication when appliance compromise is suspected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts