Chinese Espionage Group Deploys New Malware in U.S. Microsoft 365 Campaign

WASHINGTON — A Chinese state-sponsored espionage group known as UNC5221 has deployed new malware variants to maintain persistent access to compromised Microsoft 365 environments and other networks across the United States. The operation, identified on Thursday, marks a significant escalation in the group's tactics as it seeks to evade security controls and establish long-term footholds within victim infrastructures.

The group, also tracked under the alias VerdantBamboo, utilized two distinct pieces of malicious software in the campaign: Plenet and AgentPSD. These tools were designed to facilitate command and control communications and ensure continued access to targeted systems even after initial intrusion methods were detected. Security researchers noted that the deployment of these specific tools indicates a shift toward more sophisticated persistence mechanisms.

UNC5221 has been active for several years, primarily targeting government agencies, defense contractors, and technology firms. The group's operations are believed to be aligned with Chinese state interests, focusing on the theft of intellectual property and sensitive government data. The recent activity in the United States represents the latest chapter in a long-running campaign of cyber espionage.

The malware deployment was detected following an analysis of network traffic anomalies and unusual authentication patterns within Microsoft 365 environments. The Plenet tool functions as a remote access trojan, allowing operators to execute commands on infected machines. AgentPSD, a PowerShell-based loader, was used to download and execute additional payloads, further entrenching the group's presence within the compromised networks.

Cybersecurity experts warn that the use of legitimate Microsoft tools in conjunction with custom malware makes detection more difficult. The group leveraged living-off-the-land techniques, utilizing built-in system utilities to mask malicious activity. This approach complicates the work of defenders who rely on traditional signature-based detection methods.

The United States government has not yet publicly commented on the specific incidents or the extent of the compromise. However, officials have previously warned of the persistent threat posed by Chinese cyber actors. The Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency continue to monitor the situation and advise organizations to review their security postures.

The campaign raises questions about the scope of the intrusion and the potential data exfiltration. It remains unclear how many organizations were affected or what specific information may have been accessed. Security firms are currently working with affected entities to remediate the vulnerabilities and remove the malicious software.

As the investigation continues, the focus remains on understanding the full impact of UNC5221's activities. The group's ability to adapt its tools and tactics suggests that similar operations may occur in the future. Organizations are urged to implement robust monitoring and incident response capabilities to detect and mitigate such threats.