Verdant Bamboo: Just Another BRICKSTORM in the Firewall
Summary: Volexity's September 2025 incident response found a Chinese threat actor it tracks as VerdantBamboo (WARP PANDA, UNC5221) had compromised an Egnyte Storage Sync appliance using valid SSH credentials for the default egnyteservice account, deploying the BRICKSTORM backdoor and using the appliance's proxying to reach the victim's Microsoft 365 environment while evading Conditional Access policies. The initial compromise dated back at least 18 months, and after remediation VerdantBamboo returned through stolen administrative credentials on the victim's internet-exposed firewall, then deployed the PLENET backdoor to a Synology NAS; Volexity also found the victim's MSP had a pfSense firewall compromised with a FreeBSD variant of BRICKSTORM for at least 18 months.
Bottom line: The actor sat undetected for at least 18 months on an appliance with no EDR coverage, then re-entered after remediation through a firewall whose administrative interface was exposed to the internet with credentials not protected by MFA - and the MSP that managed these systems was itself root-compromised.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026