China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks

Researchers at Nviso identified Windows-based variants of the Brickstorm backdoor linked to UNC5221 operating against European organizations of strategic interest to China. The Windows variants provide file manager and network tunneling capabilities (used for lateral movement with valid credentials) and are designed to evade network defenses via DNS over HTTPS, nested TLS, and cloud-based C2 infrastructure; Windows builds reportedly omit direct command execution to reduce detection, and activity has been observed since at least 2022.