Chinese APT Malware Uses New Tools to Maintain Network Access

Researchers have uncovered new malware used by a Chinese cyber espionage group to maintain access inside compromised networks.

The campaign involved multiple previously undocumented tools that helped attackers remain active after the initial breach. Investigators say the malware was designed to support long-term intelligence gathering, allowing operators to move through victim environments while reducing the chances of detection.

The discovery offers fresh insight into how state-sponsored threat actors continue expanding their arsenal to target enterprise and cloud infrastructure.

Researchers Discover New Persistence Tools

Security researchers linked the activity to UNC5221, a threat group associated with Chinese cyber espionage operations.

During their investigation, researchers identified two previously unknown malware families, Plenet and AgentPSD, alongside the Brickstorm backdoor. The tools were deployed after attackers gained access to victim environments and appeared to focus on maintaining a lasting foothold.

Unlike ransomware attacks that seek immediate financial gain, espionage campaigns often prioritize stealth. Attackers may remain inside networks for months while collecting sensitive information and monitoring activity.

The newly identified malware supports that objective by helping operators preserve access and manage compromised systems.

Cloud Services Remain a Key Target

Researchers observed the threat actors operating within Microsoft 365 environments, highlighting the growing importance of cloud platforms in modern cyber espionage campaigns.

Cloud services store large volumes of business communications, documents, and authentication data. Successful access can provide valuable intelligence while allowing attackers to move across connected systems.

As organizations continue migrating workloads to cloud environments, threat groups are increasingly adapting their tools to operate beyond traditional corporate networks.

The campaign demonstrates that cloud infrastructure now represents a major battleground for advanced threat actors.

Malware Designed for Stealth

The attackers used several tools rather than relying on a single backdoor.

This layered approach improves resilience during an intrusion. If defenders identify and remove one component, attackers may still retain access through another mechanism already deployed inside the environment.

Researchers noted that the malware helped support command-and-control communications and ongoing operations within compromised systems. These capabilities allow espionage groups to maintain visibility into target networks while avoiding disruption that could attract attention.

Such tactics have become increasingly common among sophisticated state-sponsored actors.

Organizations Face Persistent Espionage Threats

The findings underscore the continued threat posed by advanced cyber espionage groups.

Organizations should closely monitor authentication activity, review privileged account access, and maintain visibility across both on-premises and cloud environments. Security teams should also investigate unusual persistence mechanisms that may indicate unauthorized access.

As threat actors continue developing custom malware, defenders face growing challenges in identifying and removing sophisticated intrusions before sensitive information is exposed.

Conclusion

The Chinese APT malware campaign highlights how modern espionage groups prioritize persistence and stealth over immediate disruption. By deploying multiple malware families and targeting both enterprise networks and cloud environments, attackers can maintain access for extended periods while gathering valuable intelligence.

The discovery serves as another reminder that advanced threat actors continue evolving their techniques, making proactive monitoring and strong security controls essential for organizations worldwide.