Google: Brickstorm malware used to steal U.S. orgs' data for over a year

Brickstorm, a Go-based backdoor attributed to suspected Chinese-linked UNC5221, was used in long-term espionage against U.S. technology, legal, SaaS, and BPO organizations by exploiting edge-device zero-days (notably VMware vCenter/ESXi). The malware provides web server, file manipulation, SOCKS proxy, and shell execution capabilities to siphon emails and repository data with an average dwell time of 393 days while evading EDR on appliances; researchers released YARA rules and a scanner to help detection.