BRICKSTORM has surfaced as a highly evasive backdoor targeting organizations within the technology and legal industries, exploiting trust relationships to infiltrate critical networks.

First detected in mid-2025, this malware leverages multi-stage loaders and covert communication channels to avoid detection.

Early victims reported unusual latency in remote desktop sessions, prompting deeper forensic investigations.

As the campaign evolved, BRICKSTORM demonstrated a remarkable ability to blend into legitimate system processes, complicating incident response efforts and extending dwell time.

Initial analysis reveals BRICKSTORM’s primary propagation vector is spear-phishing emails containing weaponized document attachments.

These attachments exploit a zero-day flaw in a widely used document rendering engine, silently deploying a lightweight loader once opened.

In several cases, organizations in the legal sector noted the lure of case summaries or contract amendments as decoys.

The loader subsequently fetches an encrypted payload from a compromised cloud storage service, establishing a stealthy foothold before initiating lateral movement.

Google Cloud analysts identified BRICKSTORM after observing anomalous traffic patterns across its infrastructure monitoring platform.

Correlating telemetry from endpoint sensors and network logs, researchers noted connections to unusual domain names using nonstandard ports.

These discoveries accelerated threat intelligence sharing across industry CERTs, culminating in the attribution of the backdoor to a previously unseen modular malware family.

A characteristic feature of BRICKSTORM is its modular design, enabling operators to tailor functionality according to target environment.

Core modules include system reconnaissance, credential harvesting, and secure communication channels. Upon deployment, BRICKSTORM enumerates running processes and open network sockets, alerting operators to high-value targets and active security tools.

When a suitable target is found, the backdoor injects a reconnaissance module into memory, extracting credentials via in-memory process dumps.

All data is exfiltrated using an HTTP-over-DNS tunnel, effectively bypassing traditional egress filtering rules.

Persistence Tactics

Delving into BRICKSTORM’s persistence mechanism reveals a cunning approach that relies on dynamically registered scheduled tasks.

Rather than creating permanent registry entries, the backdoor generates a transient scheduled task named to mimic legitimate system maintenance jobs.

Upon each system boot, the task executes a PowerShell command that reconstructs the loader from segmented fragments stored in alternate data streams.

This technique not only conceals the backdoor components within benign files but also rotates fragment locations on each run, preventing static indicators of compromise.

$parts = Get-Item -Path "C:\Windows\System32\drivers\etc\hosts":frag*
$loader = ""
foreach ($p in $parts) {
    $loader += ([IO.File]::ReadAllText($p.Name))
}
Invoke-Expression $loader

By leveraging alternate data streams, BRICKSTORM sidesteps file-based defenses and leaves minimal traces on disk.

Incident responders often overlook ADS entries, allowing the backdoor to persist undetected across reboots.

Moreover, the use of dynamic task names prevents easy correlation during log analysis, as each deployment may appear distinct.

Understanding these tactics is critical for defenders aiming to develop detection rules that surface anomalous scheduled tasks and ADS activity in real time.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New BRICKSTORM Stealthy Backdoor Attacking Tech and Legal Sectors appeared first on Cyber Security News.

In recent weeks, security researchers have observed a surge in targeted attacks attributed to the COLDRIVER advanced persistent threat (APT) group.

This adversary has introduced a new PowerShell-based backdoor, dubbed BAITSWITCH, which exhibits sophisticated command-and-control techniques while blending into legitimate Windows processes.

Initial sightings trace back to late July 2025, when intrusion attempts against government non-profits in Southeast Asia began to spike, leveraging spear-phishing emails that carried weaponized Office documents.

These documents, when opened, silently invoked PowerShell scripts that established the foothold for BAITSWITCH. Early indicators suggest that the group refined its social-engineering lures to mimic internal memos, increasing click-through rates among high-value targets.

Following these initial incursions, Zscaler researchers noted that BAITSWITCH diverges from typical script-based loaders by embedding its entire payload within encoded PowerShell commands.

Rather than downloading binaries directly from public repositories, the loader unpacks an encrypted module directly in memory. This approach minimizes forensic artifacts on disk, hindering traditional antivirus tools.

Within a week of its emergence, Zscaler analysts identified lateral-movement attempts by BAITSWITCH operators, demonstrating usage of built-in Windows utilities such as Invoke-Command and Get-Service to enumerate and pivot across the network .

By September 2025, incident response teams reported compromised Active Directory accounts in several organizations, with exfiltration of proprietary documents and system snapshots.

The impact of BAITSWITCH extends beyond data theft; its stealthy communication channels have allowed the actor to reside dormant for weeks before executing destructive payloads.

Organizations with incomplete PowerShell logging or lacking network egress monitoring have proven especially vulnerable to undetected persistence.

Infection Mechanism

The infection chain of BAITSWITCH hinges on a multi-stage PowerShell deployment sequence. First, victims receive a lure document with macros that execute the following snippet upon user interaction:-

$EncPayload = "JHtQcml2YXRlS2V5fQ=="
$Decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($EncPayload))
Invoke-Expression $Decoded

This code decodes a Base64-encoded string containing the next-stage loader. The loader then performs an AES decryption routine using a hard-coded key within the script to reveal the final backdoor module:

Function Decrypt-Module($cipherText,$key){
    $AES = [System.Security.Cryptography.Aes]::Create()
    $AES.Key = [Convert]::FromBase64String($key)
    $AES.Mode = 'CBC'
    $AES.IV = $AES.Key[0..15]
    $decryptor = $AES.CreateDecryptor()
    return [System.Text.Encoding]::UTF8.GetString($decryptor.TransformFinalBlock([Convert]::FromBase64String($cipherText),0,$cipherText.Length))
}

Upon decryption, BAITSWITCH registers itself as a scheduled task named “WindowsUpdateSvc” and injects its commands into the svchost.exe process to evade detection.

The backdoor communicates with its C2 server over HTTPS, masquerading traffic as routine Windows Update requests. This infection mechanism underscores COLDRIVER’s emphasis on script-only payloads and operational security, complicating both detection and remediation efforts.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post COLDRIVER APT Group Uses ClickFix To Deliver a New PowerShell-Based Backdoor BAITSWITCH appeared first on Cyber Security News.