Published on: 2025-12-04

AI-powered OSINT brief from verified open sources. Automated NLP signal extraction with human verification. See our Methodology and Why WorldWideWatchers.

Intelligence Report: PRC spies Brickstormed their way into critical US networks and remained hidden for years

1. BLUF (Bottom Line Up Front)

Chinese state-sponsored actors have infiltrated critical US networks using the Brickstorm malware, maintaining access for extended periods. This operation has compromised multiple sectors, including government and IT services. The most likely hypothesis is that these actions are part of a broader strategic campaign by the PRC to gather intelligence and potentially disrupt US infrastructure. Overall confidence in this assessment is moderate due to existing information gaps.

2. Competing Hypotheses

• Hypothesis A: The PRC is conducting a coordinated cyber-espionage campaign targeting US critical infrastructure to gather intelligence and prepare for potential future disruptions. This is supported by the sophisticated nature of the Brickstorm malware and its deployment across various sectors. However, specific attribution to a particular PRC group remains unconfirmed.
• Hypothesis B: The Brickstorm intrusions are isolated incidents conducted by independent threat actors within China, not directly coordinated by the state. This is less supported due to the scale and sophistication of the operations, which suggest state-level resources and objectives.
• Assessment: Hypothesis A is currently better supported due to the strategic targeting and complexity of the malware, indicative of state-sponsored activity. Confirmation of specific PRC group involvement or additional evidence of state coordination could further solidify this judgment.

3. Key Assumptions and Red Flags

• Assumptions: The PRC has the capability and intent to conduct long-term cyber-espionage operations; Brickstorm is primarily used for intelligence gathering and potential disruption; US critical infrastructure is a high-value target for PRC cyber operations.
• Information Gaps: Specific identification of the PRC group responsible; full extent of the compromised networks; detailed objectives of the intrusions.
• Bias & Deception Risks: Potential confirmation bias in attributing the activity to the PRC; reliance on public and potentially biased sources; possibility of misdirection by the threat actors to obscure true intentions.

4. Implications and Strategic Risks

The ongoing cyber intrusions by PRC actors could lead to increased geopolitical tensions and necessitate a reassessment of US cyber defense strategies. The persistence of these threats underscores the need for enhanced cybersecurity measures across critical sectors.

• Political / Geopolitical: Escalation in US-PRC cyber tensions; potential diplomatic fallout and increased sanctions.
• Security / Counter-Terrorism: Heightened threat environment for US critical infrastructure; potential for future disruptive cyber operations.
• Cyber / Information Space: Increased focus on cyber defense and information security; potential for retaliatory cyber operations by the US.
• Economic / Social: Potential economic impacts from compromised IT services; public concern over cybersecurity vulnerabilities.

5. Recommendations and Outlook

• Immediate Actions (0–30 days): Deploy detection tools like the open-source scanner from Mandiant; enhance monitoring of critical infrastructure networks; initiate diplomatic communications to address the cyber threat.
• Medium-Term Posture (1–12 months): Strengthen public-private cybersecurity partnerships; invest in advanced threat detection and response capabilities; develop contingency plans for potential disruptions.
• Scenario Outlook:
  • Best Case: Successful mitigation of current threats and improved US-PRC cyber relations.
  • Worst Case: Escalation to disruptive cyber attacks on critical infrastructure.
  • Most Likely: Continued low-level cyber-espionage with periodic escalations.

6. Key Individuals and Entities

• Nick Andersen, Executive Assistant Director for Cybersecurity, CISA
• Austin Larsen, Principal Analyst, Google Threat Intelligence Group
• UNC5221, Suspected Chinese cyber group

7. Thematic Tags

Cybersecurity, cyber-espionage, PRC cyber operations, critical infrastructure, malware

Structured Analytic Techniques Applied

• Adversarial Threat Simulation: Model and simulate actions of cyber adversaries to anticipate vulnerabilities and improve resilience.
• Indicators Development: Detect and monitor behavioral or technical anomalies across systems for early threat detection.
• Bayesian Scenario Modeling: Quantify uncertainty and predict cyberattack pathways using probabilistic inference.
• Network Influence Mapping: Map influence relationships to assess actor impact.

Explore more:
Cybersecurity Briefs ·
Daily Summary ·
Support us