# Chinese APT Maintains Hidden Access for 18+ Months Using Advanced Malware Arsenal
## The Threat
A sophisticated Chinese espionage group has demonstrated alarming persistence in compromised enterprise networks, evading detection for over 18 months while deploying multiple custom backdoors to maintain access across victim infrastructure. Threat researchers at Volexity recently uncovered the campaign by UNC5221 (also known as VerdantBamboo), revealing a multi-layered intrusion strategy that compromised not only primary target organizations but also their managed services providers (MSPs), creating a complex web of compromised assets that could facilitate further attacks downstream.
The threat actor's toolkit includes Brickstorm, an advanced backdoor malware available in both Golang and Rust variants, along with newly documented malware families named Plenet (tracked by Google as "Grimbolt") and AgentPSD. The sophistication of this campaign—combined with the attacker's ability to re-establish access even after incident response efforts—illustrates the evolving capabilities of Chinese state-sponsored threat actors targeting U.S.-based organizations.
## Background and Context
### Who Is UNC5221/VerdantBamboo?
UNC5221 has been active in cyber espionage campaigns since at least 2023, focusing on exploiting zero-day vulnerabilities in edge devices to establish initial network access. The group is assessed to be operating in support of Chinese government interests, with targeting patterns consistent with economic and technological intelligence gathering.
Previous documented activity:
The group has demonstrated sustained focus on maintaining persistent access to high-value targets rather than conducting smash-and-grab data exfiltration, indicating a long-term intelligence collection objective.
## Technical Details
### Initial Compromise and Persistence
The Volexity investigation revealed a methodical multi-stage attack:
1. Initial access: Attackers compromised an Egnyte Storage Sync system and accessed it periodically through the victim's web-based SSL VPN—a gateway device that, due to its privileged network position and frequent internet connectivity, provided an ideal persistent foothold.
2. Credential harvesting and lateral movement: Using stolen credentials from the compromised Egnyte system combined with Brickstorm's proxying capabilities, the attackers established access to the victim's Microsoft 365 environment. Volexity assessed with high confidence that the attackers used Brickstorm to proxy traffic and blend with legitimate network flows, specifically to evade Conditional Access policies that would otherwise flag suspicious sign-ins.
3. Extended dwell time: The attackers operated undetected for at least 18 months before the initial breach discovery around March 2025.
### The Malware Arsenal
Brickstorm Backdoor
- Interactive command shell access
- Remote code execution
- Traffic proxying to blend attacker activity with legitimate network flows
- Persistence across system reboots
Plenet (Grimbolt)
- Interactive shell access
- Remote command execution
- File manipulation and exfiltration
- Dynamic C2 server switching
- WebSocket-based command and control communications
AgentPSD
### Re-Compromise and Second Intrusion
After Volexity's incident response team completed initial remediation efforts, attackers regained access using a different attack vector:
1. Firewall access: Stolen credentials were used to enable and configure SSL VPN access on the victim's firewall
2. NAS deployment: Attackers deployed custom malware to a Synology NAS device
3. MSP pivot: This activity triggered an investigation at the victim's MSP, where researchers discovered a BSD variant of Brickstorm installed on a pfSense firewall
4. Extended compromise: Volexity concluded with medium confidence that the MSP's compromised firewall had also been accessed for at least 18 months, suggesting the attacker pivoted from the MSP back into the victim environment during the second intrusion
## Implications for Organizations
### Scope of Exposure
This campaign reveals several critical attack surface areas that organizations commonly under-protect:
| Asset Type | Risk Factor | Finding |
|-----------|------------|---------|
| Storage sync appliances | CRITICAL | Primary entry point; weak default security posture |
| Network edge devices | CRITICAL | Dual-homed systems vulnerable to lateral movement |
| MSP infrastructure | CRITICAL | Compromised service providers can re-compromise customers |
| Conditional Access policies | HIGH | Can be bypassed through traffic proxying |
| Backup and archive systems | HIGH | Often neglected in security monitoring |
### Key Vulnerabilities in Current Defenses
## Recommendations
### Immediate Actions
1. Audit external-facing appliances for unauthorized administrative access and SSL VPN configurations
- Enforce multi-factor authentication on all VPN access points
- Log all VPN authentication attempts and review historical logs for suspicious patterns
- Deploy network segmentation to isolate appliances from sensitive systems
2. Review MSP relationships and capabilities
- Audit MSP infrastructure for evidence of compromise (Brickstorm signatures, unusual processes, backdoor artifacts)
- Require MSPs to implement network segmentation preventing cross-customer lateral movement
- Establish contractual security baselines and conduct quarterly security assessments
3. Implement behavioral analytics for Microsoft 365 and network infrastructure
- Deploy detection rules for suspicious proxy behavior and unusual geographic login patterns
- Monitor for signs of persistent shell access to appliances
### Long-Term Strategies
---
## HackWire Analysis
This incident exemplifies a troubling evolution in Chinese state-sponsored cyber operations: the shift from opportunistic data exfiltration to deliberate, long-term infrastructure infiltration designed for sustained intelligence collection. The 18-month dwell time isn't a failure of the attacker—it's a statement of intent and confidence.
What makes UNC5221's approach particularly dangerous is its redundancy-first architecture: three separate malware families (Brickstorm, Plenet, AgentPSD) deployed across multiple asset types, with built-in fallback mechanisms. This isn't malware; it's a persistent infrastructure-as-a-service operation embedded in victim networks.
The re-compromise after incident response is equally revealing. Most organizations conduct remediation with the assumption that once you've ejected the attacker, they're gone. VerdantBamboo's strategy demonstrates that stolen credentials, compromised MSPs, and overlooked appliances function as permanent backdoors. The attacker didn't need to find a new zero-day—they simply used the same weak points they exploited the first time, because the victim hadn't actually closed them.
For defenders, the critical lesson isn't about Brickstorm's technical capabilities—it's about raising the bar on what "remediated" actually means. Closing one compromised Egnyte appliance while leaving firewall access intact is theater, not incident response. Organizations targeting UNC5221 must treat every compromised system as a potential re-entry point, assume that credentials are permanently burned, and implement network changes—not just malware removal—to prevent recurrence.
The involvement of an MSP should also trigger a broader supply-chain security review. If your MSP's infrastructure is compromised, and they manage your infrastructure, you are compromised. Period. This requires contractual language and technical controls that today's MSP relationships rarely include.
— HackWire Editorial
---
## Related Coverage