Fast Facts

• BRICKSTORM is a custom-built malware used by China-linked hackers to spy on US tech, legal, and SaaS firms.
• Attackers remained undetected in some networks for over a year, targeting both service providers and their clients.
• The campaign exploits zero-day vulnerabilities in Linux and BSD systems, moving laterally to high-value targets like VMware servers.
• Credential theft and advanced obfuscation help attackers tunnel through networks and evade security tools.
• Experts warn that the attack is part of a wider strategy to steal intellectual property and disrupt global competition.

Inside the Breach: A Network of Shadows

Imagine a digital heist so quiet, so methodical, that the victims don’t notice until the thieves are long gone. That’s the unsettling reality facing US tech firms after revelations of the BRICKSTORM campaign-a sprawling, year-long espionage operation orchestrated by a China-linked hacking group known as UNC5221.

BRICKSTORM didn’t smash through firewalls with brute force. Instead, it slipped in through unseen cracks-zero-day vulnerabilities in the very operating systems (Linux and BSD) that power the backbone of many companies. Like termites hollowing out a house, the attackers first burrowed into network appliances, then crept laterally, hopping from device to device using stolen credentials. Their destination? The crown jewels: VMware servers that manage the digital lifeblood of modern enterprises.

From VPNs to Vendor Chains: The New Face of Cyber Espionage

This isn’t UNC5221’s first act. Earlier in 2025, the same group was tied to the mass exploitation of Ivanti VPN flaws, echoing previous supply chain attacks like the infamous SolarWinds breach. But BRICKSTORM marks an evolution. It’s written in Go, a programming language prized for its speed and stealth, and it uses techniques like advanced obfuscation-scrambling its code to slip past even the sharpest digital watchdogs.

The hackers’ endgame extends beyond a single company. By infecting SaaS and business process outsourcing firms, they gain access not just to one set of secrets, but to an entire constellation of clients, partners, and sensitive communications. Their favorite targets? System administrators, developers, and anyone with the keys to the kingdom-especially those whose emails and access could unlock even deeper levels of trade secrets or national security data.

According to Mandiant, attackers even abused Microsoft’s Entra ID (formerly Azure AD) to sneak into mailboxes with elevated privileges, giving them an unobstructed view into the nerve centers of their victims’ operations.

Echoes of Espionage: A Global Stakes Game

The BRICKSTORM campaign is a stark reminder that modern cyber attacks aren’t just smash-and-grab jobs-they’re long cons, with attackers quietly mapping the digital supply chain for months. As Ensar Seker, CISO at SOCRadar, puts it, this is about “building capabilities that can support multiple future attacks.” In other words, every compromised service provider becomes a launchpad for even bigger breaches, raising the specter of cascading risks across industries.

The geopolitical implications are as serious as the technical ones. With intellectual property and sensitive trade information in play, the campaign isn’t just about theft; it’s about tilting the scales of global competition.

WIKICROOK

• Zero: A zero-day vulnerability is a hidden security flaw unknown to the software maker, with no fix available, making it highly valuable and dangerous to attackers.
• Lateral movement: Lateral movement is when attackers, after breaching a network, move sideways to access more systems or sensitive data, expanding their control and reach.
• Obfuscation: Obfuscation is the practice of disguising code or data to make it difficult for humans or security tools to understand, analyze, or detect.
• SaaS (Software as a Service): SaaS (Software as a Service) delivers cloud-based software online, letting users access and manage apps without local installation or maintenance.
• Supply chain attack: A supply chain attack is a cyberattack that compromises trusted software or hardware providers, spreading malware or vulnerabilities to many organizations at once.