Chinese Hackers Steal U.S. Legal and Tech Data for Over a Year

Summary Points

1. Chinese hacker group UNC5221 has been infiltrating U.S. organizations using the BRICKSTORM backdoor for over a year, targeting legal firms, SaaS companies, and tech organizations for espionage, IP theft, and zero-day development.
2. The group exploits vulnerabilities and employs sophisticated techniques, including lateral movement through networks and targeting VMware vCenter, often remaining undetected for approximately 393 days.
3. BRICKSTORM malware is actively developed, targeting Linux, BSD, and VMware systems, with a focus on network appliances and virtual infrastructure, enabling cloning of critical VMs and accessing sensitive data.
4. Attackers use stolen credentials and tools like Microsoft Entra ID, SOCKS proxies, and UNC paths to access emails, files, and internal systems, aiming to gather intelligence for China’s national security and economic interests.

The Issue

For months, suspected Chinese hackers, specifically a group called UNC5221, have been covertly infiltrating various U.S. organizations, including law firms, SaaS companies, and tech firms, to conduct espionage and steal sensitive information. Using a sophisticated backdoor called BRICKSTORM, these hackers have established long-term access—often over a year—by exploiting vulnerabilities in network appliances, especially VMware systems like vCenter and ESXi hosts. Their goal appears to be multi-faceted: to gather intelligence for economic and national security interests, to extract intellectual property, and to develop new zero-day vulnerabilities for future exploitation. Reported by Google’s Threat Intelligence Group and Mandiant, the attacks are characterized by their stealth, with the hackers often going undetected by typical security tools, and their ability to move laterally through networks, clone critical virtual machines, and access email accounts of high-value personnel, including those involved in Chinese strategic and economic activities.

The threat actors’ efforts are driven by a combination of espionage, intellectual property theft, and the desire to create new vulnerabilities for future attacks. By targeting high-profile infrastructure components such as VMware management systems and web applications, they aim to access sensitive organizational data, including emails and proprietary information, with some operations designed to remain hidden for nearly 13 months. The report emphasizes that these intrusions are linked to a broader pattern of Chinese cyber espionage, distinct from other Chinese groups like Silk Typhoon, and highlight vulnerabilities in poorly monitored appliance networks and cloud environments. The investigations reveal a calculated, persistent effort to infiltrate and manipulate vital technological infrastructure, with the attackers actively developing and refining their tools to maintain undetected access over extended periods.

Risks Involved

For months, suspected Chinese hackers, mainly attributed to the group UNC5221, have stealthily infiltrated U.S. networks—especially targeting legal firms, SaaS companies, BPOs, and tech organizations—using sophisticated backdoors like BRICKSTORM to establish persistent access that can last over a year. These intrusions exploit zero-day vulnerabilities in network appliances, VMware hosts, and other systems, often going undetected due to poor inventory management and the deliberate design of the malware, which often avoids standard detection tools. The hackers move laterally within networks, cloning virtual machines, and compromising critical infrastructure, including email accounts and web applications, to steal sensitive data, intellectual property, and national security information. Their activities aim not only at espionage and theft of proprietary innovations but also at developing future exploit techniques, posing profound threats to organizational security, national interests, and the integrity of technological infrastructure across sectors.

Possible Remediation Steps

Addressing the ongoing threat of Chinese hackers stealing data from U.S. legal and tech firms over an extended period is critical to protecting sensitive information, maintaining competitive advantages, and safeguarding national security. Prompt and effective remediation ensures that vulnerabilities are minimized, preventing further breaches and restoring trust.

Containment Strategies

• Isolate compromised systems to prevent lateral movement.
• Disable affected accounts and revoke suspicious access credentials.

Investigation and Assessment

• Conduct thorough forensic analysis to determine breach extent.
• Identify compromised data and system vulnerabilities.

Patch and Update

• Apply security patches to close exploited vulnerabilities.
• Update software and firmware regularly to fix known flaws.

Strengthen Security Measures

• Implement multi-factor authentication across all access points.
• Deploy intrusion detection and prevention systems.

Monitoring and Response

• Establish continuous monitoring for unusual activity.
• Develop or refine incident response plans for rapid action.

Training and Awareness

• Educate staff on cybersecurity best practices and threat recognition.
• Conduct simulated attack drills to improve response readiness.

Policy and Compliance

• Review and update security policies to align with current threats.
• Ensure compliance with relevant regulations and standards.

Advance Your Cyber Knowledge

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1