Chinese APT deploys new malware to keep access to hacked networks
UNC5221 used Brickstorm, Plenet, and AgentPSD to stay inside victim networks for months and keep re-entry options open.
Intelligence analysis by GPT-5.4 Mini
Volexity says the Chinese espionage group UNC5221, also tracked as VerdantBamboo, maintained long-term access to a victim network and its MSP by mixing stolen credentials, proxying, and new backdoors. The campaign shows how attackers can survive cleanup by planting multiple persistence mechanisms across internal systems and appliances.
A sneaky intruder got into a company’s computers, left spare keys in several places, and even came back after cleanup. It is like hiding extra house keys under different flowerpots so the door can still be opened later.
Analysis
Volexity says UNC5221, a Chinese espionage group also known as VerdantBamboo, stayed inside a victim environment for at least 18 months before detection. The attackers first used the Brickstorm backdoor to reach Microsoft 365 and other internal systems, then returned after remediation efforts and re-established access.
The intrusion was not limited to one machine. According to the report, the group also compromised the victim organization’s managed services provider and used that access as part of the broader operation. In one case, they reached an Egnyte Storage Sync system and then moved into Microsoft 365 by using Brickstorm’s proxying features along with stolen credentials. Volexity says this likely helped the attackers look like normal traffic and bypass Conditional Access controls.
After the initial cleanup, the attackers came back and used stolen credentials to enable SSL VPN access on the firewall, then deployed additional malware to a Synology NAS device. That second wave led investigators to the MSP, where they found a BSD version of Brickstorm on a pfSense firewall. Volexity concluded that the firewall and the storage sync system had also been compromised well before the breach was discovered.
The group then deployed two newer tools. Plenet, also called Grimbolt by Google, is a .NET backdoor that can open an interactive shell, run commands, move files, and switch C2 servers. AgentPSD is a simpler Python reverse shell that Volexity believes was meant as fallback persistence if other malware stopped working.
The report paints UNC5221 as a highly capable actor that blends living-off-the-land activity with custom malware, especially on systems where EDR is not available.
Key points
- UNC5221 kept access to the victim network for at least 18 months before detection.
- The attackers used Brickstorm, then later deployed Plenet and AgentPSD as additional persistence tools.
- Volexity says the group also compromised the victim’s MSP, which may have helped the pivot into the target environment.
- The campaign used stolen credentials, SSL VPN access, and appliance-level footholds to avoid detection and regain entry.
- The researchers published indicators of compromise tied to the intrusion.
The report gives defenders concrete signs to hunt for, including Brickstorm-related infrastructure and other indicators of compromise. If organizations improve monitoring on VPNs, firewalls, NAS devices, and MSP links, they may catch this kind of long-term access earlier.
The case shows that even after remediation, attackers may still have alternate paths back into the network. If organizations rely on weak visibility or trust their MSP and appliance layers too much, the same intrusion can repeat for months.
