Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

BRICKSTORM has appeared to resemble legitimate processes to include the vCenter process `vami-http`. BRICKSTORM has also leveraged legitimate names of VMware vSphere platform such as `vmsrc` or `vmware-sphere`.

SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control.

BRICKSTORM has uploaded files from the victim system to C2 servers.

SPAWNCHIMERA has executed only in memory and hooked itself into existing processes on the victim device to include the web process.

SPAWNCHIMERA has searched for running processes to include web or dsmdm.

BRICKSTORM has executed shell commands using `/bin/sh`.

BRICKSTORM has the ability to delete files and directories. BRICKSTORM also has deleted installer files after execution to reduce detection.

BRICKSTORM has communicated to hardcoded C2 through WebSockets (WSS) to include domains associated with Cloudflare Workers. BRICKSTORM has also leveraged Gorilla mux library to serve its HTTP API calls.

BRICKSTORM has used DNS over HTTPS to resolve C2 infrastructure and obscure DNS traffic from inspection.

SPAWNCHIMERA has obtained system information such as release, uptime, and current time.

BRICKSTORM has identified specific files and directories within targeted hosts and systems for modification, execution, collection and exfiltration.

BRICKSTORM has leveraged SOCKS Proxy to pivot into victim networks in attempts to resemble legitimate administrative traffic.

BRICKSTORM has the ability to download files from the Adversaries C2 server to the compromised system.

SPAWNCHIMERA has checked where SELinux is enabled on the targeted host.

SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.

SPAWNCHIMERA has the ability to bind on a localhost and listen on port 8300.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

BRICKSTORM has utilized a SOCKS proxy to tunnel access within the victim network and exfiltrate files from internal shares, code repositories, and other endpoints. BRICKSTORM has also leveraged Yamux for combining multiple concurrent logical streams over a single a socket.

SPAWNCHIMERA can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.

SPAWNCHIMERA has been compiled as a Position Independent Executable (PIE) to use a third-party library for injection.

SPAWNCHIMERA has disabled logging and log forwarding on Ivanti devices targeting the `dslogserver` process.