New Chinese Malware Targets Microsoft 365 Networks

Emily Davis · 2026-06-05

A Chinese espionage group known as UNC5221 has been spotted breaking into Microsoft 365 environments using a nasty backdoor called Brickstorm, plus two new pieces of malware named Plenet and AgentPSD. This isn't just another cyberattack story. It's a wake-up call for anyone relying on cloud services to run their business. If you're in IT security or manage sensitive data, you need to understand how these threats work and what you can do about them. ### How the Attack Unfolds The attackers don't just waltz in. They start by exploiting weak or stolen credentials to access Microsoft 365 accounts. Once inside, they deploy Brickstorm, a backdoor that gives them persistent access to the network. Think of it like leaving a secret door open after the main entrance is locked. From there, they drop Plenet and AgentPSD. These are custom tools designed to steal data, move laterally across systems, and maintain a foothold even if the initial breach is detected. It's a layered approach that makes cleanup a nightmare.  ### What Makes These Malware Different Plenet is particularly sneaky. It disguises itself as legitimate network traffic, making it hard for standard security tools to spot. AgentPSD, on the other hand, focuses on credential theft and privilege escalation. Together, they form a powerful combo that can bypass many defenses. This isn't your average ransomware gang. UNC5221 is an advanced persistent threat (APT) group, meaning they're patient, well-funded, and focused on long-term espionage. Their goal isn't a quick payday—it's sustained access to sensitive information. ### Why Microsoft 365 Is a Prime Target Microsoft 365 is everywhere. It's used by governments, Fortune 500 companies, and small businesses alike. That makes it a juicy target for espionage groups. Once they're inside, they can access emails, files, and collaboration tools without raising alarms. The shift to remote work has only made things worse. More people are accessing cloud services from home networks, which are often less secure. Attackers exploit this by targeting VPNs, outdated software, and weak passwords. ### What You Can Do to Protect Yourself Don't wait for a breach to happen. Here are some practical steps you can take right now: - Enable multi-factor authentication (MFA) on every account. It's the single most effective defense. - Use strong, unique passwords for each service. A password manager can help. - Monitor your Microsoft 365 sign-in logs for unusual activity, like logins from unfamiliar locations. - Keep all software updated, including browsers and operating systems. - Consider using an antidetect browser for sensitive online work. These tools change your browser fingerprint, making it harder for attackers to track or target you. ### The Role of Antidetect Browsers in Defense Antidetect browsers aren't just for privacy enthusiasts. They're becoming essential for security professionals who need to protect their digital identity. By masking your browser fingerprint, you reduce the risk of being tracked or profiled by malicious actors. For example, if you're managing multiple accounts or accessing sensitive systems, an antidetect browser can prevent attackers from correlating your activities. It's an extra layer of anonymity that complements traditional security tools. ### Final Thoughts Cyber threats are evolving fast. The UNC5221 group is just one example of how sophisticated attackers have become. But you don't have to be a victim. By staying informed and taking proactive steps, you can significantly reduce your risk. Remember, security isn't a one-time fix. It's an ongoing practice. Keep learning, keep updating, and keep questioning whether your defenses are truly up to the challenge.