Chinese Hackers Gone Wild: Brickstorm Backdoor Bombshell Rocks US Tech and Legal Titans

This is your Digital Frontline: Daily China Cyber Intel podcast. Ting here, your favorite cyber sleuth dishing the Digital Frontline scoop for September 24, 2025, and listeners, there’s truly never a dull day when Chinese hackers are active. First up: the *Brickstorm* backdoor is the latest magic trick Chinese threat actors are pulling out of their hats—used to infiltrate American legal firms, SaaS providers, and technology heavyweights. Google’s Threat Intelligence Group and Mandiant are calling Brickstorm “next-level,” and I agree. If your company relies on VMware, cloud infrastructure, or runs anything sensitive through third-party SaaS vendors, pay extra attention—UNC5221 and their friends are exploiting edge devices and staying stealthy for months, sometimes more than a year. Charles Carmakal at Mandiant calls them “the most prevalent adversary in the US,” and the dwell time is astonishing, averaging 393–400 days. That’s more than a year of snooping before anyone realizes something’s off. The hacks are impressively persistent: Rather than just snagging some sensitive documents and ghosting, these teams mine emails of developers, sysadmins, and lawyers specializing in national security or international trade. They’re on the hunt for valuable intellectual property, juicy trade secrets, and code vulnerabilities to fuel the next round of zero-day exploits. Their favorite trick involves lurking inside systems without EDR (endpoint detection and response), especially VMware ESXi hypervisors, email gateways, and security scanners. John Hultquist of GTIG compared their upstream movement to Russia’s infamous SolarWinds campaign—these folks don’t just compromise companies, but hop into customer networks downstream, creating supply chain risks that ripple outward. Legal firms have been prime targets—Wiley Rein in Washington, DC lost control of sensitive correspondence, and tech companies have seen proprietary code exfiltrated. According to Cryptopolitan, these break-ins are part of Beijing’s broader effort to gather negotiating intel for ongoing trade disputes. Government investigations are in full swing, with the FBI blasting out advisories and urging organizations to check tips.fbi.gov if suspicious. But wait, there’s more! RedNovember, tracked by Recorded Future and Microsoft as Storm-2077, has been hammering US defense contractors, cloud firms, aerospace companies, and government entities since June. These pros love hitting perimeter devices: VPNs, firewalls, load balancers, virtualization boxes. Their toolkit? Open-source favorites like Pantegana and Spark RAT, plus classics like Cobalt Strike. RedNovember’s global reach is matched only by their trickery, shuffling VPNs and cleaning up after themselves to dodge attribution. Their flexible and relentless tactics mean the US, Taiwan, South Korea, and even Panama have felt the sting lately. So, what are the defensive moves? Google and Mandiant have rolled out scanner tools and YARA rules This content was created in partnership and with the help of Artificial Intelligence AI.