Story perspectives

Chinese Spies Exploit Vulnerabilities, Go Undetected for 393 Days

9/25/2025

43 8

Summary

Story summary

Google Threat Intelligence reports UNC5221-linked Chinese spies have infiltrated numerous enterprise networks since March, undetected on average for 393 days.
They exploit Ivanti device vulnerabilities, using BRICKSTORM backdoors to maintain access and steal data.
Mandiant has released a free scanner to help organizations detect BRICKSTORM activity.
Organizations should monitor unusual network activity and apply Tactics, Techniques, and Procedures (TTP)-based detection.

1 of 1

Story summary

Google Threat Intelligence reports UNC5221-linked Chinese spies have infiltrated numerous enterprise networks since March, undetected on average for 393 days.
They exploit Ivanti device vulnerabilities, using BRICKSTORM backdoors to maintain access and steal data.
Mandiant has released a free scanner to help organizations detect BRICKSTORM activity.
Organizations should monitor unusual network activity and apply Tactics, Techniques, and Procedures (TTP)-based detection.