Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Check Point Research

Kaspersky Security Blog

CVE Database V5

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is being used to maintain persistent access to victim organizations in the United States. Since March 2025, Mandiant Consulting has responded to intrusions across a range of industry verticals, most notably legal services, Software as a Service (SaaS) providers, Business Process Outsourcers (BPOs), and Technology. The value of these targets extends beyond typical espionage missions, potentially providing data to feed development of zero-days and establishing pivot points for broader access to downstream victims.

BRICKSTORM is a sophisticated backdoor malware campaign identified by the Google Threat Intelligence Group and Mandiant Consulting, active since March 2025. It targets organizations primarily in the United States but poses a risk globally, including Europe, especially in legal services, SaaS providers, BPOs, and technology sectors. The malware facilitates stealthy, persistent access to victim environments, enabling espionage activities that may support zero-day exploit development and provide pivot points for broader network compromise. BRICKSTORM affects both Windows and Linux systems and is associated with VMware vCenter components, indicating targeting of virtualized infrastructure. The malware employs multiple MITRE ATT&CK techniques such as T1071 (using application layer protocols for command and control), T1566 (phishing for initial access), T1546 (event-triggered execution for persistence), T1036 (masquerading), T1003 (credential dumping), and T1021 (remote services like SSH). It also uses SOCKS proxies and SSH tunneling to obfuscate network traffic and maintain covert communications. Indicators of compromise include specific MD5 and SHA1 hashes and YARA signatures. The adversary behind this campaign is UNC5221, a group linked to espionage operations. No known public exploits or CVEs are associated yet, and no patches are available. The campaign's medium severity rating reflects its espionage focus, persistence, and complexity, though it requires initial access and some level of user or system interaction to deploy. The malware's ability to maintain long-term access and target high-value sectors makes it a significant threat for organizations handling sensitive intellectual property and confidential data.

MD5 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df

MD5 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878

MD5 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035

SHA1 of 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df

SHA1 of 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035

SHA1 of aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878

Detailed information about Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog. Get real-time updates, tech

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'socks proxy'

Filter Threats

Scan a website for live threats in under a minute

Threats Tagged 'socks proxy'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility