UNC5221 BRICKSTORM Malware Targets U.S. Legal and Technology Companies

Have you ever thought about how hackers can stay hidden in a system for months without detection? That's what UNC5221 is doing right now. They are a stealthy hacking group targeting certain U.S. legal, technology, SaaS, and business companies, where they are using malware called BRICKSTORM.

What is BRICKSTORM?​

BRICKSTORM differs from regular malware in that it:

• Can execute commands on a host machine
• It can organize files
• Can be a network tunnel to move around internally
• Can run on Linux and BSD servers

It can even communicate with its command-and-control server via WebSockets to help it go undetected by regular security tools.

How UNC5221 Gets In​

UNC5221 typically compromises Ivanti Connect Secure systems that they can identify aka drift detect weaknesses, to penetrate networks. Once inside, they are capable of:

• Steal passwords with BRICKSTEAL
• Copy virtual servers for critical-related information
• Remain undetected with in-memory changes that do not require a server reboot to be enacted

Some versions of BRICKSTORM will wait months before contacting the hackers, making detection even harder.

What They Want​

The main objective is mail and secrets, sensitive information from employees and key personnel. And by establishing a foothold in SaaS providers, they can access other companies' data. In essence, they effectively open doors to targets without any friction.

How to Safeguard Yourself​

Google published a script to access BRICKSTORM on Linux and BSD systems, but it’s complicated because they work to avoid standard security measures. Companies need to routinely monitor the health of their servers and applications, particularly those that do not have formal security measures.

Why This Matters​

This attack indicates that hackers continue to become more intelligent and patient for their end goal. They are no longer looking for a quick data theft. They are invading and retaining long-term access and control of critical systems was determined when this writer quickly adapted the screen name named "unc5221". Although the original hacker may be ahead in regard to BRICKSTORM, they are engaging in a slow, intelligent game that is developed long before they got on anyone's radar. You can be left off-guard.