Verdant Bamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
Summary: Volexity attributed an intrusion to a China-nexus cluster it calls VerdantBamboo, which it says overlaps with Clay Typhoon, UNC5221, and Warp Panda, and which deployed a BSD variant of the BRICKSTORM backdoor plus malware families PLENET and AGENTPSD on Linux systems. Discovered during a September 2025 incident response engagement, the intrusion compromised a victim's Egnyte Storage Sync system through a local privilege escalation flaw fixed in version 13.13 in March 2026, with the initial compromise assessed to have occurred at least 18 months earlier and the actor returning after remediation via stolen administrative credentials and a breached MSP's pfSense firewall.
What you should know: The entry point was the victim's Managed Services Provider, whose pfSense firewall was infected with a BSD variant of BRICKSTORM around the same time the victim's Storage Sync system was breached - meaning the trust placed in an MSP was the attack path. VerdantBamboo targeted appliances that traditionally do not or cannot run EDR software, and the initial compromise predated discovery by at least 18 months.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-22769
- Related
- CVE-2026-22769: Dell Recover Point for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability Known Exploited Vulnerabilities · Feb 18, 2026