Chinese cyberspies maintained long-term access to critical networks – sometimes for years – and used this access to infect computers with malware and steal data, according to Thursday warnings from government agencies and private security firms.

PRC-backed goons infected at least eight government services and IT organizations with Brickstorm backdoors, according to a joint security alert from the US Cybersecurity and Infrastructure Security Agency, the US National Security Agency, and the Canadian Cyber Security Centre.

However, “it’s a logical conclusion to assume that there are additional victims out there until we have not yet had the opportunity to communicate with,” CISA’s Nick Andersen, executive assistant director for cybersecurity, told reporters on Thursday, describing Brickstorm as a “terribly sophisticated piece of malware.”

The backdoor works across Linux, VMware, and Windows environments, and while Andersen declined to attribute the malware infections to a specific People’s Republic of China cyber group, he said it illustrates the threat PRC crews pose to US critical infrastructure.

“State-sponsored actors are not just infiltrating networks,” Andersen said. “They’re embedding themselves to enable long term access, disruption, and potential sabotage.”

In one incident that CISA responded to, the PRC goons gained access to the organization’s internal network in April 2024, uploaded Brickstorm to an internal VMware vCenter server, and used the backdoor for persistent access until at least September 3.

While in the victim’s network, the crew also gained access to two domain controllers and an Active Directory Federation Services server, which they used to steal cryptographic keys.

Dozens of organizations in the US have been impacted by Brickstorm, not including downstream victims

Google Threat Intelligence, which first sounded the alarm on Brickstorm in a September report, “strongly” recommended organizations run the open-source scanner that Google-owned Mandiant published on GitHub to help detect the backdoor on their appliances.

“We believe dozens of organizations in the US have been impacted by Brickstorm, not including downstream victims,” Google Threat Intelligence Group principal analyst Austin Larsen told The Register. “These actors are still actively targeting US organizations and are evolving Brickstorm and their techniques after our September report.”

[…]

Source: PRC spies Brickstormed their way into critical US networks • The Register

South Korean e-commerce platform Coupang over the weekend said nearly 34 million Korean customers’ personal information had been leaked in a data breach that had been ongoing for more than five months.

The company said it first detected the unauthorized exposure of 4,500 user accounts on November 18, but a subsequent investigation revealed that the breach had actually compromised about 33.7 million customer accounts in South Korea.

The breach affected customers’ names, email addresses, phone numbers, shipping addresses, and certain order histories, per Coupang. More sensitive data like payment information, credit card numbers, and login credentials was not compromised and remains secure, the company said.

Coupang said it has reported the incident to the Korea Internet & Security Agency (KISA), the Personal Information Protection Commission (PIPC), and the National Police Agency.

One of South Korea’s biggest e-commerce platforms, Coupang also offers an online commerce service called “Rocket Delivery” in the country, and also operates its marketplace in Taiwan. A Coupang spokesperson told TechCrunch that the investigation has found no evidence that consumer data from Coupang Taiwan or Rocket Now, its food delivery service in Japan, was affected in the data breach.

“According to the investigation so far, it is believed that unauthorized access to personal information began on June 24, 2025, via overseas servers,” the company said. “Coupang blocked the unauthorized access route, strengthened internal monitoring, and retained experts from a leading independent security firm.”

Police have reportedly identified at least one suspect, a former Chinese Coupang employee now abroad, after launching an investigation following a November 18 complaint.

[…]

Source: Korea’s Coupang says data breach exposed nearly 34M customers’ personal information | TechCrunch