Chinese Espionage Tool Embedded in US Systems

Security researchers uncovered a Chinese-linked cyberespionage campaign that embedded itself across U.S. infrastructure and enterprise service providers for more than a year.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Google-owned threat intel company Mandiant said in a blog post that it has tracked Brickstorm malware activity since March 2025 across industries including legal services, software-as-a-service providers, business process outsourcers and technology firms. The campaign’s objective, Mandiant said, “extends beyond typical espionage missions” and may support the development of zero-day exploits or enable broader access to downstream victims.

The report indicates that the Brickstorm campaign – linked to Chinese-nexus threat clusters tracked as UNC5221 – targets infrastructure and appliances often excluded from traditional security coverage, enabling long-term, low-visibility access. By breaching high-value service providers, researchers said the attackers can pivot into sensitive enterprise environments, marking a shift toward more persistent and technically advanced espionage operations.

Brickstorm is a custom Go-based backdoor with SOCKS proxy functionality, built for Linux and BSD appliances that lack traditional endpoint detection and response coverage. Mandiant said it identified several variants of the malware using obfuscation, delayed beaconing in at least one case and masquerading techniques to evade detection, with frequent deployments on VMware ESXi and vCenter systems.

Mandiant previously linked the same threat group to malware discovered on Ivanti VPN appliances in April, where attackers attempted to tamper with the internal Ivanti Integrity Checker Tool to evade detection (see: Chinese Espionage Group Targeting Legacy Ivanti VPN Devices).

Mandiant said the threat actor demonstrates a deep understanding of appliance-level blind spots, using modified startup scripts, web shells and in-memory payloads to evade detection and maintain persistence. Researchers observed instances where the attackers actively monitored ongoing incident response efforts and deployed new Brickstorm samples to reestablish access in real-time, according to the report.

Brickstorm malware is often tailored to appear as legitimate appliance processes, Mandiant said, including file names and functionality specifically designed to blend into a host environment. The report also noted the use of digital services to manage command-and-control infrastructure without reusing the same domains for different victims.