Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

Date: 06/08/2026

Severity: High

Summary

A China-linked cyber-espionage campaign attributed to UNC5221 targeted U.S. law firms and technology organizations. The attackers exploited zero-day vulnerabilities, deployed the BRICKSTORM backdoor, and maintained access for over a year to steal sensitive legal, trade, and national security information. The campaign highlights the growing focus on law firms as high-value intelligence targets and underscores the importance of behavioral threat hunting and robust infrastructure monitoring.

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:    

https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms/