12OCT

BRICKSTORM dwell hits 393 days, Mandiant

3 min read

10:55UTC

Mandiant's M-Trends 2026 set the China-nexus benchmark at a 393-day average dwell inside VMware hypervisors. The telemetry built for malware does not see it.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

China-nexus attackers are averaging over a year of undetected access inside the virtualisation layer.

Mandiant, the Google-owned incident-response firm, published its annual M-Trends 2026 report this month based on more than 500,000 hours of incident response, disclosing a 393-day average undetected dwell time for UNC5221's BRICKSTORM campaign⁠¹. UNC5221 is a China-nexus espionage cluster; BRICKSTORM is a Go-language backdoor that lives on VMware vCenter and ESXi hosts, the management plane and the hypervisor of most enterprise virtualisation estates. The primary targets are US and UK legal services, Business Process Outsourcers (BPOs, firms that run back-office operations on behalf of clients), Software-as-a-Service (SaaS) providers and technology companies.

The tradecraft bypasses classic endpoint telemetry entirely. A companion servlet filter called BRICKSTEAL captures the vCenter Hypertext Transfer Protocol (HTTP) Basic Authentication credentials used by administrators; domain-controller virtual machines are cloned at the hypervisor layer for offline credential extraction; and mailbox access is achieved through legitimate Microsoft Entra Identity (Entra ID) Enterprise Apps granted the `mail.read` or `full_access_as_app` permission scopes. Command-and-control traffic is relayed through Cloudflare Workers and Heroku, meaning blocklist-based network defences see benign cloud traffic rather than known-bad infrastructure.

The 393-day figure is a calibration point. Any enterprise whose detection-to-eviction time exceeds that number is performing below the observed China-nexus median attacker advantage. For London legal-sector incident-response leads in particular, the benchmark sits uncomfortably close to the reality of a firm that runs a six-month threat-hunt cycle and processes no hypervisor-level forensic data between cycles. EDR sensors, designed to catch malware running on laptops and servers, see nothing at the ESXi layer because they are not installed there.

Deep Analysis

In plain English

UNC5221 is a Chinese hacking group that broke into the infrastructure layer of organisations' computer systems: specifically, the software that runs virtual machines. Think of it as breaking into the machine room that controls all the offices in a building, rather than breaking into the offices themselves. The group spent an average of 393 days inside victims' systems before being detected. During that time, they copied credentials, cloned domain controller virtual machines for offline analysis, and accessed email accounts through permissions they had quietly granted themselves. Mandiant, the Google-owned threat intelligence firm, revealed this in their annual M-Trends 2026 report, which is based on over 500,000 hours of incident response work. The affected organisations were primarily US and UK law firms, business services companies, and technology providers.

Deep Analysis

Root Causes

VMware vCenter and ESXi are the hypervisor management plane for virtualised enterprise environments. Compromising them gives an attacker a god's-eye view of all virtual machines without touching any of them directly. Standard endpoint security agents run inside virtual machines; they cannot monitor the hypervisor layer that controls them.

The use of Cloudflare Workers and Heroku as command-and-control relays exploits a structural limitation of network monitoring: both platforms serve legitimate traffic for millions of organisations, making their domain names and IP ranges uncategorisable as malicious by conventional threat-intelligence feeds. Blocking them would break legitimate business applications.

What could happen next?

Risk
Any enterprise whose detection and response time is shorter than 393 days but whose vCenter and ESXi logging retention is less than 393 days cannot determine retrospectively whether it was compromised by this campaign.
Consequence
UK law firms and business process outsourcers handling confidential client data face regulatory obligations under both GDPR and professional privilege rules if BRICKSTORM intrusions are retrospectively discovered during incident reviews triggered by this advisory.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2019-2020 Hafnium campaign against Microsoft Exchange servers, which used web shells and Living-off-the-Land techniques to establish long-term persistence in legal, defence, and research targets in the UK and US. Like BRICKSTORM, Hafnium avoided endpoint malware in favour of server-side implants that blended with legitimate admin activity. The structural parallel is persistence on the authentication infrastructure itself, rather than on user endpoints.

Counter-parallel: The 2020 SolarWinds SUNBURST compromise averaged roughly six months of dwell before Mandiant's own systems flagged the anomaly. The 393-day BRICKSTORM figure is substantially longer, suggesting UNC5221 learned from the tradecraft improvements that allowed SUNBURST detection and specifically chose infrastructure-layer implants where endpoint telemetry has no visibility.

Consensus view: Mandiant's M-Trends 2026 characterises the BRICKSTORM/BRICKSTEAL combination as the most sophisticated China-nexus persistence technique observed in enterprise environments, specifically because command-and-control through Cloudflare Workers and Heroku produces traffic that is structurally indistinguishable from legitimate SaaS API calls, defeating blocklist and anomaly-based network monitoring.

Counter-view: IISS analysts note that the 393-day average dwell figure reflects intrusions that were eventually detected; the population of intrusions that have not yet been detected would produce a higher number, meaning 393 days is a lower bound on the median China-nexus dwell advantage, not its true value.

Key tension: Whether hypervisor-layer detection (VMware vCenter logging, ESXi introspection) is achievable at the speed needed to catch a campaign whose indicators are confined to legitimate cloud traffic patterns, or whether the detection gap is structurally unsolvable without fundamental changes to hypervisor security architecture.

Sources:Google Cloud / Mandiant·Google Cloud / Mandiant

Mentions:Mandiant →UNC5221 →BRICKSTORM →VMware vCenter →Cloudflare Workers →Heroku →Microsoft Entra Identity →Google →China →M-Trends 2026 →Microsoft →IISS →ESXi →SolarWinds →

First Reported In

Update #1 · Stryker MDM wipe exposes identity perimeter

Google Cloud / Mandiant· 17 Apr 2026

Read original →

Causes and effects

Caused by

CL-STA-1132 exploited PAN-OS since 16 April, log destruction confirmed

CL-STA-1132 is the third state-nexus cluster in two updates using the same perimeter-device doctrine as UNC5221 BRICKSTORM on VMware.

Occurred 16 Apr 2026

Read story →

This Event

BRICKSTORM dwell hits 393 days, Mandiant

The China-nexus attacker median advantage is now more than a year of undetected access inside legal firms, BPOs and SaaS providers.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.