Hidden “BRICKSTORM” Backdoor Uncovered in Network Framework
We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!
Stealthy “BRICKSTORM” Backdoor Imperils Network Infrastructure
Quick Read
- BRICKSTORM is a surveillance malware linked to the China-associated UNC5221 APT.
- Developed in Go, it averages a dwell time of 393 days.
- Targets network devices such as firewalls and virtualization platforms.
- Utilizes obfuscation and unique C2 domains for stealth.
- Aimed at data exfiltration and geopolitical surveillance.
- Possible connections to Silk Typhoon or Hafnium APT factions.
- Mandiant provides a BRICKSTORM detection utility on GitHub.
The BRICKSTORM Threat Landscape
Google’s Threat Intelligence Group (GTIG) and Mandiant have provided insights into a complex backdoor surveillance malware named BRICKSTORM. Associated with the Chinese UNC5221 advanced persistent threat (APT), this malware has been operational since March, demonstrating an impressive capability to remain undetected for an average of 393 days in compromised networks.
Focus on Network Infrastructure
BRICKSTORM specifically targets network devices like firewalls, virtual private network (VPN) concentrators, and virtualization platforms such as VMware vCenter. These intrusions are designed to secure long-term, covert access, installing backdoors on devices that typically lack endpoint detection and response (EDR) capabilities.
Stealth and Obfuscation Techniques
This malware employs obfuscation methods, uses disposable command and control (C2) domains, and integrates fluidly with device workflows, thus complicating detection efforts. Such tactics enable it to avoid typical security defenses.
Espionage and Data Exfiltration
BRICKSTORM emphasizes data exfiltration, utilizing the SOCKS network protocol to bypass firewalls and security measures. It also engages in geopolitical surveillance and theft of intellectual property, aiding in the development of exploits. Among the sensitive information collected are admin mailboxes from compromised systems.
Relation to Other APT Groups
While BRICKSTORM’s operations suggest links to known factions like Silk Typhoon or Hafnium, Google-Mandiant proposes that it may represent a separate APT due to its specific targeting strategies.
Efforts in Detection
Mandiant has taken significant steps to facilitate detection by releasing a BRICKSTORM scanning Bash script on GitHub, suitable for Linux and BSD-based systems, offering an invaluable resource for cybersecurity experts.
Conclusion
The identification of the BRICKSTORM backdoor underlines the changing threat landscape in cyber espionage aimed at network infrastructure. With its extended persistence and intricate stealth strategies, it presents a considerable challenge for detection and countermeasures.