Chinese APT deploys new malware to keep access to hacked networks

Research page generated from configured evidence sources. Treat this as an analyst workbench: facts are sourced, gaps are labelled, and low-confidence chatter is separated from confirmed evidence.

Executive judgement

• Priority score: 25
• Confidence: medium
• Exploit status: none — No public exploitation signal captured by the configured pipeline yet.
• CISA KEV: No CISA KEV match captured in configured source data at generation time.
• Published/observed: 2026-06-05

What happened

A Chinese espionage group tracked as UNC5221 has been accessing Microsoft 365 environments using the Brickstorm backdoor and previously undocumented malware named Plenet and AgentPSD. […]

Why it matters

• The item was promoted because the pipeline observed: priority score 25, exploit status none, confidence medium.
• No CVE was extracted from the source story yet, so this should be treated as a news/campaign cluster until primary technical identifiers are found.
• No PoC signal was detected by the current pipeline unless shown elsewhere on this page.

Evidence collected

• NEWS: Chinese APT deploys new malware to keep access to hacked networks

Exploitation and PoC status

• Current automated assessment: No public exploitation signal captured by the configured pipeline yet.
• Public exploit/PoC: No PoC source captured yet by the configured pipeline.
• Exploited in the wild: Not confirmed by configured sources at generation time.
• Ransomware association: No ransomware association captured at generation time.

Dark web / low-confidence chatter

• AlienVault OTX pulse: Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign
• AlienVault OTX pulse: Matryoshka #3/3: Gamaredon’s Gammasteel Infostealer
• AlienVault OTX pulse: Argamal: Malware hidden in hentai games
• AlienVault OTX pulse: Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO

Defender actions

• Enable Microsoft 365 audit logging and use Advanced Hunting to search for suspicious PowerShell execution (e.g., AgentPSD) or unusual file creation events associated with UNC5221 TTPs.
• Implement Conditional Access policies requiring MFA for all administrative and user access to Microsoft 365, and block legacy authentication protocols.
• Deploy endpoint detection and response (EDR) rules to detect and block execution of known Brickstorm, Plenet, and AgentPSD malware hashes.

Exposure validation ideas

• Search asset inventory for affected vendor/product names and any CVE reference.
• Check internet-facing exposure through approved tools only: Shodan/Censys/GreyNoise links below are research starting points, not proof of exposure.
• Prioritise management interfaces, edge devices, identity/control-plane systems, and OT/ICS assets where relevant.

Detection / hunting ideas

• Review vendor logs for authentication failures, privilege changes, unexpected admin activity, and anomalous management-plane access.
• Search SIEM/EDR telemetry for product-specific process names, network services, and newly published indicators from primary sources.
• Monitor for scanner traffic or nuclei/metasploit module references once public exploit tooling appears.

Research links

• GitHub code/advisory search
• GitHub repository search
• Exploit-DB search
• Packet Storm search
• AlienVault OTX search
• GreyNoise search
• Shodan search
• Censys search

Open questions

• Is there a primary vendor advisory with exact affected versions and fixed versions?
• Has CISA KEV, Shadowserver, GreyNoise, or a trusted vendor confirmed exploitation?
• Are there credible PoC repositories or only secondary reporting mentioning PoC?
• Is there underground/forum/leak-site discussion, or only public reporting?

Generated: 2026-06-05T19:30:30+00:00