VerdantBamboo Used BRICKSTORM and PLENET to Persist via Edge Appliances

Volexity reported that the China-linked threat actor VerdantBamboo—also tracked as WARP PANDA and UNC5221—compromised an organization through its managed services provider and maintained access for at least 18 months by abusing edge infrastructure and proprietary appliances. Investigators found the actor on an Egnyte Storage Sync appliance, where it deployed BRICKSTORM as its primary implant and used AGENTPSD as a fallback reverse shell, then pivoted with stolen credentials and SSL VPN access to reach internal systems and Microsoft 365 while bypassing Conditional Access protections.

The intrusion also affected the victim’s MSP, where Volexity found a pfSense firewall running a FreeBSD variant of BRICKSTORM and assessed with medium confidence that the MSP breach was the likely initial access path. During the investigation, Volexity identified a local privilege escalation issue tied to sudo permissions for Egnyte’s default egnyteservice account, later fixed in Storage Sync v13.13, and documented a new .NET Native AOT backdoor named PLENET on a Synology NAS. The findings indicate VerdantBamboo deliberately targets appliances and firewall-adjacent systems that often lack EDR coverage, using them as covert proxies and long-term persistence points.