The Chinese cyber espionage group UNC5221 has been using the sophisticated BRICKSTORM malware to conduct long-term espionage operations against U.S. organizations, specifically targeting the legal, technology, SaaS, and business process outsourcing (BPO) sectors. BRICKSTORM, a Go-based backdoor, is capable of web serving, file manipulation, acting as a SOCKS relay, and executing shell commands. It is deployed on appliances that often lack traditional endpoint detection and response (EDR) solutions, allowing it to remain undetected for an average of 393 days. The campaign, monitored by Mandiant and Google’s Threat Intelligence Group (GTIG), aims to steal sensitive data, including intellectual property and emails, and potentially develop zero-day vulnerabilities for further exploitation. The malware has been linked to the exploitation of zero-day vulnerabilities in Ivanti products and has been used to target VMware vCenter and ESXi hosts. BRICKSTORM’s stealthy nature is enhanced by the use of anti-forensics scripts and the rotation of command-and-control (C2) domains. The malware’s primary goal is to exfiltrate emails and other valuable data, leveraging its SOCKS proxy feature for stealthy data tunneling. CTIX has linked a scanner script released by Mandiant to detect BRICKSTORM activity, although it may not capture all variants or persistence mechanisms.