MalwarePublished 5 Jun 2026

Chinese APT deploys new malware to keep access to hacked networks

Source Bleeping Computer

Description

A Chinese espionage group tracked as UNC5221 has been accessing Microsoft 365 environments using the Brickstorm backdoor and previously undocumented malware named Plenet and AgentPSD. [...]

Impact

The threat actor achieved prolonged unauthorized access to victim networks, including Microsoft 365 environments and managed service providers, enabling espionage and potential data exfiltration. The malware allowed remote command execution, file manipulation, and persistent backdoor access, complicating detection and remediation efforts. The attackers' ability to blend with legitimate traffic and evade Conditional Access policies increased the difficulty of preventing access. The compromise of MSP infrastructure also facilitated lateral movement and secondary intrusions. Although no direct exploits or vulnerabilities are involved, the impact includes significant operational compromise and data security risks for targeted organizations.

Defensive guidance

No official patches apply as this is malware-based activity rather than a software vulnerability. Organizations should focus on detection and remediation of the malware and unauthorized access. Given the attackers' use of living-off-the-land techniques and evasion of Conditional Access, defenders should review and strengthen identity and access management controls, monitor for unusual VPN and proxy usage, and investigate any persistent or unusual processes on critical infrastructure such as VPN appliances, storage sync systems, NAS devices, and firewalls. Incident response should include thorough network and endpoint forensics to identify and remove all malware variants and backdoors. MSPs should be included in security assessments due to their role in the attack chain. No vendor advisory or official fix is available; patch status is not applicable.

References

bleepingcomputer.com/news/security/chinese-apt-deploys-new-malware-to-keep-access-to-hacked-networks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Jun 2026, 18:18 UTC

References

Community reviews