cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

UNC5221 Used Brickstorm, Plenet, and AgentPSD to Maintain Long-Term Access

· Original article ↗

Summary

Volexity says UNC5221 (VerdantBamboo) accessed a victim’s network and Microsoft 365 environment for at least 18 months, also compromising its MSP and deploying Brickstorm, Plenet, and AgentPSD as backdoors.

Key points

  • Volexity found that UNC5221 had access to the victim’s network for at least 18 months before detection.
  • The actor accessed Microsoft 365 using stolen credentials and proxying after compromising an Egnyte Storage Sync system.
  • Volexity found a second intrusion after remediation and said the actor also compromised the victim’s MSP; it assessed with medium confidence that the actor pivoted from the MSP.
  • Brickstorm was found on systems including an Egnyte appliance, a retired Linux email archive server, and the MSP’s pfSense firewall.
  • Plenet is a cross-platform .NET backdoor with interactive shell, remote command execution, file manipulation, and C2-switching capabilities.
  • AgentPSD is a Python reverse-shell utility that Volexity believes was intended as fallback persistence; investigators said it was not used while Brickstorm remained active.

Article Details

Attack Vectors
  • UNC5221 accessed the victim’s Microsoft 365 environment using stolen credentials and Brickstorm’s proxying features after compromising an Egnyte Storage Sync system reachable through the victim’s web SSL VPN.
  • In a later intrusion, the attackers used stolen credentials to enable and configure SSL VPN access on the victim’s firewall, then connected to internal systems.
  • Volexity assessed with medium confidence that VerdantBamboo pivoted from the victim’s MSP into the victim organization’s environment.
  • The attackers deployed Brickstorm and additional malware, including Plenet on a Synology NAS and a BSD variant of Brickstorm on an MSP pfSense firewall.

MITRE ATT&CK

T1071.001 · Web ProtocolsPlenet used WebSocket communications for command and control.T1078.004 · Cloud AccountsUNC5221 used stolen credentials to access the victim’s Microsoft 365 environment.T1090 · ProxyThe attackers used Brickstorm’s proxying features while accessing the victim’s Microsoft 365 environment.T1105 · Ingress Tool TransferThe attackers deployed Brickstorm and additional custom malware to victim and MSP systems.T1133 · External Remote ServicesThe attackers accessed the victim’s network through its web SSL VPN and later enabled and configured SSL VPN access on the victim’s firewall.

Threat Actors

ARMORY CASTLEThe article reports that UNC5221 compromised victim and MSP systems, used Brickstorm and other malware, and maintained access for at least 18 months. The source says UNC5221 is also tracked as VerdantBamboo.UNC6201The article says Google reported that UNC6201 deployed Brickstorm against Dell RecoverPoint for Virtual Machines.VerdantBambooThe article reports that VerdantBamboo compromised the victim’s Egnyte Storage Sync system and MSP, used stolen credentials and malware, and re-entered the victim’s environment. The source says VerdantBamboo is also tracked as UNC5221.

Malware

AGENTPSDUNC5221, also tracked as VerdantBamboo, compromised Microsoft 365 environments using the Brickstorm backdoor along with newly identified malware Plenet and AgentPSD.BRICKSTORMUNC5221, also tracked as VerdantBamboo, compromised Microsoft 365 environments using the Brickstorm backdoor along with newly identified malware Plenet and AgentPSD.BrockstormThe researchers note that Plenet is similar in design to Brockstorm, using the WebSocket protocol for C2 communications and a multiplexing library for simultaneous data streams to the server.PLENETUNC5221, also tracked as VerdantBamboo, compromised Microsoft 365 environments using the Brickstorm backdoor along with newly identified malware Plenet and AgentPSD.

Products

Dell RecoverPoint for Virtual MachinesCISA warned about Brickstorm being deployed by Chinese hackers against VMware vSphere servers, and, more recently, Google reported that it was deployed by UNC6201 against Dell RecoverPoint for Virtual Machines.Egnyte Storage SyncThe attackers gained access to Microsoft 365 through compromised Egnyte Storage Sync and stolen credentials.GroupWiseBrickstorm was then deployed to the victim’s Egnyte Storage Sync appliance and to a retired Linux GroupWise email archive server.Microsoft 365 Apps for EnterpriseUNC5221, also tracked as VerdantBamboo, compromised Microsoft 365 environments using the Brickstorm backdoor along with newly identified malware Plenet and AgentPSD.pfSense#UNC5221Synology#UNC5221VMware vSphereCISA warned about Brickstorm being deployed by Chinese hackers against VMware vSphere servers, and, more recently, Google reported that it was deployed by UNC6201 against Dell RecoverPoint for Virtual Machines.

Countries

United StatesThe threat actor used the Brickstorm backdoor undetected in the environments of various targets in the United States for more than a year until the breaches were discovered around March 2025.

Industries

Legal servicesUNC5221 activity using the backdoor, and then again in September 2025, describing attacks against legal services, software-as-a-service providers, business process outsourcers, and technology companies.Software-as-a-service providersthe backdoor, and then again in September 2025, describing attacks against legal services, software-as-a-service providers, business process outsourcers, and technology companies.Technologyattacks against legal services, software-as-a-service providers, business process outsourcers, and technology companies.

Related Articles