Chinese APT VerdantBamboo Uses BRICKSTORM Malware to Compromise Firewalls and Appliances

Cybersecuritynews •Tushar Subhra Dutta • June 5, 2026

A Chinese state-linked hacking group has been quietly living inside corporate networks for well over a year, using a custom malware toolkit to compromise firewalls, storage systems, and network appliances without ever tripping an alarm. The group, tracked as VerdantBamboo, has shown a level of patience and technical precision that sets it apart from most […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese APT VerdantBamboo Exploits Brickstorm Malware for Long-term Network Access The Chinese espionage group UNC5221, also known as VerdantBamboo, has been using the Brickstorm backdoor and new malware variants Plenet and AgentPSD to maintain access to compromised Microsoft 365 environments. Investigations revealed that the group had infiltrated victim networks at least 18 months prior to detection, compromising managed services providers (MSPs) to facilitate their attacks. Brickstorm is described as an advanced malware implant, initially developed in Golang and later in Rust. The group has targeted various sectors, including legal services and technology companies, exploiting zero-day vulnerabilities in edge devices since at least 2023. The attackers employed sophisticated techniques to blend in with legitimate traffic, evading security measures. Following the initial breach, they re-entered the network and deployed additional malware, indicating a persistent threat. The ongoing investigation highlights the need for heightened vigilance against such advanced persistent threats. 4 sources 76

Extracted Entities

Chinese APT VerdantBamboo Uses BRICKSTORM Malware to Compromise Firewalls and Appliances

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)