New backdoor attacks tech and legal sectors

The BRICKSTORM backdoor targets organizations in the technology and legal sectors, exploiting relationships of trust to infiltrate critical networks.

See also: New YiBackdoor allows sensitive data to be extracted

First detected in mid-2025, this malware uses multi-stage loaders and hidden communication channels to evade detection. Early victims reported unusual latency in remote desktop sessions, prompting deeper forensic investigations.

As the campaign progressed, the BRICKSTORM backdoor demonstrated a remarkable ability to integrate into legitimate system processes, complicating incident response efforts and extending dwell time. Initial analysis reveals that the primary means of BRICKSTORM propagation is through spear-phishing emails containing malicious attachments. These attachments exploit a zero-day vulnerability in a widely used document rendering engine, silently installing a lightweight loader upon opening.

In several cases, legal organizations have observed the use of case summaries or contract amendments as bait. The loader then retrieves an encrypted payload from a compromised cloud storage service, creating a hidden base before initiating lateral movement.

See also: Russian Gamaredon and Turla install Kazuar Backdoor in Ukraine

Google Cloud analysts discovered the BRICKSTORM backdoor after observing anomalous traffic patterns in their infrastructure monitoring platform. Combining telemetry from endpoint sensors and network logs, researchers noted connections to unusual domain names using non-standard ports. These discoveries accelerated the sharing of threat intelligence across industry CERTs, resulting in the attribution of the backdoor to a previously unseen malware family with a modular design.

A distinctive feature of the BRICKSTORM backdoor is its modular design, which allows operators to customize the functionality depending on the target environment. The basic modules include system identification, credential collection, and secure communication channels. Once deployed, the BRICKSTORM backdoor enumerates running processes and open network sockets, alerting operators to high-value targets and active security tools.

When a suitable target is found, the BRICKSTORM backdoor injects an identifier into memory, extracting credentials via memory dumps. All data is extracted using an HTTP-over-DNS tunnel, effectively bypassing traditional output filtering rules.

See also: Hackers maliciously use Code Assistant to insert Backdoors

Understanding these tactics is critical for security researchers seeking to develop detection rules that highlight anomalous scheduled tasks and ADS activity in real time.