Suspected Chinese hackers used Brickstorm backdoor long-term access

Suspected Chinese hackers have used a stealthy backdoor called Brickstorm to maintain longterm access to U.S. technology and legal networks, siphoning emails, source code and other sensitive data for months or more than a year before detection, researchers said Wednesday. The campaign has targeted legal service providers, software as a service companies, business process outsourcers and technology firms, and investigators warned the intrusions could enable future attacks and widespread downstream compromise.

Researchers from Google’s Threat Intelligence Group and Mandiant described the intrusions as exceptionally sophisticated and persistent, with an average dwell time of roughly 393 to 400 days. The attackers deployed a Go based backdoor that can operate as a web server, file manipulation tool, dropper, SOCKS relay and command execution mechanism. Once inside, the actors used stolen credentials and lateral movement to access VMware vCenter and ESXi hosts, clone virtual machines, extract secrets and tunnel into internal systems to exfiltrate mailboxes and code repositories.

“This is a long term play,” John Hultquist, chief analyst at Google’s Threat Intelligence Group, said,...