Adversary Intelligence — 2026-06-06

Chinese APT UNC5221 Deploys Brickstorm and New Malware to Maintain Persistent Access to US Networks

BLUFUNC5221's persistent exploitation of EDR-blind appliances and MSP supply chains reveals a structural defensive gap that Conditional Access policies and endpoint tooling cannot currently address.

Volexity's September 2025 investigation found UNC5221 had been present in a US organization's network for at least 18 months, with BRICKSTORM backdoors on the victim's Egnyte Storage Sync appliance and the MSP's pfSense firewall 12. The actor proxied Microsoft 365 access through the victim's own SSL VPN IP space to bypass Conditional Access policies; Volexity assesses with medium confidence that the MSP breach was the original entry vector 13. Following remediation, VerdantBamboo re-entered days later via stolen admin credentials on an MFA-unprotected firewall and deployed two previously undocumented malware families: PLENET, a .NET Core backdoor Google independently tracks as GRIMBOLT, and AGENTPSD, a Python reverse shell fallback 123.

Analysis
The structural gap is that enterprise endpoint tooling and Conditional Access policies do not reach EDR-blind devices: network appliances, storage sync endpoints, and MSP-managed firewalls. VerdantBamboo proxied M365 access through the victim's own SSL VPN address space, making adversary logins indistinguishable from internal traffic. PLENET and AGENTPSD confirm layered fallback persistence survives primary implant disruption. Organizations under MSP management inherit their provider's security posture without visibility into those environments. The 18-month dwell time may reflect deliberate pacing below behavioral baselines rather than detection failure. Infrastructure went dark within days of Volexity's September 2025 fingerprint publication, confirming rapid OPSEC rotation on detection. Sourcing rests on Volexity's single investigative report; secondary outlets contribute no independent collection.

4 sources

VerdantBamboo: Just Another BRICKSTORM in the Firewall - Volexity
Chinese APT deploys new malware to keep access to hacked networks - BleepingComputer
China's VerdantBamboo Actors Latest Campaign Shows Evolution - The Cyber Express
Chinese APT VerdantBamboo Uses BRICKSTORM Malware to Compromise Firewalls and Appliances - Cybersecurity News