Over the past year, Google Cloud researchers uncovered an advanced espionage campaign they named BRICKSTORM, attributed to the suspected China-nexus group UNC5221. The campaign showcases the continued trend of state-aligned actors exploiting enterprise infrastructure to establish long-term access and stealthy command-and-control.
Key Findings
- Targeted Victims: U.S. law firms, SaaS providers, business process outsourcing (BPO) firms, and technology companies.
- Focus on Appliances and Infrastructure: Attackers deployed malware on Linux/BSD appliances and VMware vCenter/ESXi systems - environments that often lack endpoint security visibility.
- Dwell Time: On average, attackers remained undetected for over a year (393 days), underscoring both the stealth of the tools and the challenges defenders face in monitoring these platforms.
- Custom Malware – BRICKSTORM Backdoor:
- Written in Go and obfuscated with Garble.
- Supports SOCKS proxying for lateral movement and persistence.
- Utilizes a custom library (wssoft) to evade detection.
- Employs legitimate services for C2, including Cloudflare Workers, Heroku, and sslip.io.
- Evolution of Techniques:
- Introduction of variants with delayed beaconing to blend into normal network activity.
- Deployment of “BRICKSTEAL” - an in-memory Java Servlet filter running on vCenter that harvested Active Directory credentials.
Check Point customers are safeguarded through multiple layers of defense
- Check Point's Intrusion Prevention System, embedded in Quantum gateways, was added with new protections targeting this campaign. These protections are automatically downloaded to Quantum gateways, protecting our customers.
- Check Point's Threat Emulation engine* - utilized by Quantum gateways, Harmony Endpoint, Harmony Email & Collaboration, and Harmony SASE - has been updated with new protections targeting this campaign. In addition, the Anti-Bot engine**, available on Quantum gateways and Harmony Endpoint, includes new protections against BRICKSTORM command-and-control traffic.
For more information and the protection details, please read sk184082
