VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign — MSP Supply-Chain Compromise of Edge Appliances with 18-Month Dwell
VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign (TL-2026-0706), also tracked as Just Another BRICKSTORM in the Firewall, is a critical-severity advanced persistent threat campaign, first published 2026-06-07. It is attributed to VerdantBamboo (China) with high confidence, affects Egnyte Storage Sync, maps to 23 MITRE ATT&CK techniques (T1008, T1021, T1027), and is covered by 9 detection rules and 57 indicators of compromise.
Key facts for TL-2026-0706
- Threat ID
- TL-2026-0706
- Also known as
- Just Another BRICKSTORM in the Firewall
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-06-07
- Last reviewed
- 2026-06-07
- Attribution
- VerdantBamboo
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- legal services, saas, business process outsourcing, technology, managed service providers
- Target regions
- North America, United States
- Detection rules
- 9
- Indicators of compromise
- 57
Malware and tooling in VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
Malware and tooling: AGENTPSD, BRICKSTORM - S9015, PLENET, WebSocket + Nerdbank.Streams multiplexing
China-nexus espionage actor VerdantBamboo (UNC5221 / WARP PANDA) maintained access to a U.S. victim network for at least 18 months by compromising the victim's MSP and abusing EDR-less edge appliances. The actor planted BRICKSTORM (Go/Rust/BSD variants) on a pfSense firewall and an Egnyte Storage Sync Linux VM, deployed the AGENTPSD Python reverse shell as fallback, and later added the PLENET (Grimbolt) .NET backdoor on a Synology NAS — using BRICKSTORM SOCKS proxying plus stolen credentials to reach the victim's Microsoft 365 tenant and bypass Conditional Access.
How VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign works
Volexity, in an incident response engagement that began in September 2025, uncovered a long-running intrusion by the China-nexus actor VerdantBamboo (also tracked as UNC5221 and WARP PANDA). The actor had maintained covert access to the victim environment for at least 18 months, deliberately targeting network edge and infrastructure appliances — firewalls, NAS, and storage-sync VMs — that fall outside typical EDR coverage.
INITIAL ACCESS & FOOTHOLD: The earliest confirmed foothold was a Linux Egnyte Storage Sync VM, accessed via valid SSH credentials for the 'egnyteservice' account, reached through the victim's web SSL VPN. A local privilege escalation in Egnyte Storage Sync (sudoers Cmnd_Alias EGNYTEAPPS granting PASSWD-less use of /usr/bin/tee to the unprivileged egnyteservice account) allowed arbitrary file writes anywhere on the filesystem — fixed in Storage Sync v13.13. The actor also compromised the victim's Managed Service Provider (MSP) and planted a BSD-compiled BRICKSTORM variant on the MSP's pfSense firewall, providing a resilient re-entry point.
MALWARE — BRICKSTORM: A modular Golang RAT (with later Rust variants and a FreeBSD build for pfSense) built around the 'wssoft' package namespace (wssoft.core for C2/task dispatch, wssoft.libs for local ops). It communicates over WebSocket and supports pluggable task extensions: 'command' (shell), 'socks' (SOCKS5 proxy), and 'web' (filesystem interface). Instances are customized per victim with only the needed extensions; the BSD variant was obfuscated with gobfuscate. On the Storage Sync host it was placed at /usr/sbin/ (luserput); on the pfSense firewall at /usr/local/libexec/ipsec/blacklist. C2 domains are customized per victim and front through Cloudflare.
MALWARE — AGENTPSD: A PyInstaller-compiled Python reverse shell deployed as /usr/local/bin/egnyte/egnyte_host_monitor_client, assessed (medium confidence) as a fallback. It beacons over HTTPS POST with Content-Type application/octet-stream and a 'sec-fetch-tag' header carrying Base64-encoded system info, identifies clients as root_<hostname>_<hex machine UUID>, uses the hardcoded delimiter PoRaSGw3jzQ8YSaz, Base64 command encoding (ignoring the first character), and supports interval/during/builtin command types. Persistence was a crontab entry firing on the 15th at 14:20. Its C2 domain was registered but never resolved during the investigation.
MALWARE — PLENET (Google: Grimbolt): A cross-platform .NET Core backdoor compiled with Native AOT and packed with UPX, deployed to a Linux-based Synology NAS as ovs-dbctl. It uses WebSocket C2 multiplexed via the Nerdbank.Streams library and native .NET Task async, and supports interactive shell, remote command execution, file manipulation, and live C2 server switching. The .NET/AOT choice is assessed (medium confidence) as an anti-analysis measure.
LATERAL MOVEMENT & OBJECTIVE: BRICKSTORM's SOCKS proxy let the actor tunnel through trusted internal infrastructure to access the victim's Microsoft 365 environment with stolen credentials, blending with legitimate traffic and bypassing Conditional Access IP restrictions. A SLAYSTYLE webshell and additional BRICKSTORM samples were also observed. After Volexity's initial remediation, the actor regained access within days via stolen, MFA-less firewall administrative credentials and an actor-enabled SSL VPN configuration — underscoring incomplete eradication of the MSP foothold.
INFRASTRUCTURE: On 2025-09-06 Volexity built a Censys fingerprint for BRICKSTORM C2 (minimal HTTP response on 443, OpenBSD SSH on 22, Cloudflare-issued certificate, low service count); between 2025-09-18 and 2025-09-23 every matching server disabled its port 443 service, and on 2025-09-24 Google Cloud published its own BRICKSTORM analysis. VerdantBamboo demonstrates strong OPSEC: limited per-victim infrastructure, per-device implant naming/persistence, and a focus on appliances lacking endpoint telemetry.
MITRE ATT&CK techniques used in TL-2026-0706
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1572 Protocol Tunneling; T1573 Encrypted Channel
Lateral Movement
T1021 Remote Services; T1550 Use Alternate Authentication Material
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Persistence
T1053 Scheduled Task/Job; T1505 Server Software Component
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Discovery
T1083 File and Directory Discovery; T1087 Account Discovery
Collection
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Credential Access
Resource Development
defense-impairment
Affected products and versions in VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
- Egnyte — Storage Sync
Vulnerable versions: < 13.13
Fixed in: 13.13 - Netgate — pfSense (FreeBSD)
Vulnerable versions: edge firewall — all - Synology — NAS (DSM Linux)
Vulnerable versions: affected appliance - Microsoft — Microsoft 365
Vulnerable versions: tenant accessed via stolen credentials + proxy - Micro Focus / OpenText — Novell GroupWise (legacy Linux)
Vulnerable versions: legacy archive server
Remediation for VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
Patches
- Upgrade Egnyte Storage Sync to v13.13 or later to remediate the egnyteservice sudo/tee local privilege escalation
Immediate actions
- Isolate Egnyte Storage Sync systems and the web SSL VPN; hunt for BRICKSTORM at /usr/sbin/ and AGENTPSD at /usr/local/bin/egnyte/egnyte_host_monitor_client
- Force-reset all firewall administrative credentials and audit pfSense for actor-enabled SSL VPN configurations and the file /usr/local/libexec/ipsec/blacklist
- Block and hunt for the listed BRICKSTORM/PLENET C2 domains and IPs at the perimeter and in DNS logs
- Review Microsoft 365 sign-in logs for access proxied through internal/edge appliance IPs that bypassed Conditional Access
Workarounds
- Restrict the egnyteservice sudoers EGNYTEAPPS Cmnd_Alias to remove unconstrained /usr/bin/tee
- Disable unused SSL VPN and SSH access on edge appliances; restrict admin interfaces to management networks
Longer-term hardening
- Deploy Network Security Monitoring on edge segments where EDR cannot run (firewalls, NAS, sync appliances)
- Enforce MFA on all administrative accounts, especially firewall and VPN admins
- Implement Conditional Access with strict IP-based restrictions and review for proxy-bypass gaps
- Conduct regular MSP security assessments and segment MSP-managed infrastructure
Weaknesses (CWE) in VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
CWE-269, CWE-250, CWE-732
Timeline of VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
- Estimated initial compromise of the Egnyte Storage Sync VM and the MSP pfSense firewall (at least 18 months before detection).
- Suspicious outbound traffic from the Egnyte Storage Sync Linux VM first surfaces (~March 2025 per BleepingComputer).
- Volexity incident response engagement begins after suspicious network traffic from the Storage Sync VM is confirmed.
- Volexity develops a Censys fingerprint for BRICKSTORM C2 servers (minimal 443 banner, OpenBSD SSH, Cloudflare cert, low service count).
- Servers matching the BRICKSTORM fingerprint begin disabling their port 443 services.
- All fingerprinted BRICKSTORM C2 servers have taken port 443 offline.
- Google Cloud (Mandiant) publishes its BRICKSTORM analysis.
- Within days of initial remediation, VerdantBamboo regains access using stolen MFA-less firewall admin credentials and an actor-enabled SSL VPN, then redeploys BRICKSTORM and PLENET.
- Volexity publishes the VerdantBamboo report and IOC/YARA package; BleepingComputer covers the campaign.
Sources cited for VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
Threats related to VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign
- CVE-2025-53521: F5 BIG-IP APM Unauthenticated Remote Code Execution via apmd Process — Active Exploitation by UNC5221 (BRICKSTORM)
- Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 GRIMBOLT Backdoor (CVE-2026-22769)
- BRICKSTORM Backdoor: UNC5221 PRC-Nexus APT Targeting VMware vSphere Infrastructure
- CVE-2025-53521: F5 BIG-IP APM Unauthenticated Remote Code Execution via Stack-based Buffer Overflow
- Dell RecoverPoint for VMs Zero-Day (CVE-2026-22769) — CVSS 10.0, PRC-Nexus UNC6201/Silk Typhoon, BRICKSTORM/GRIMBOLT/SLAYSTYLE, VMware Ghost NIC Pivoting, iptables SPA
Detection coverage for TL-2026-0706
As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0706 across Splunk SPL, Microsoft KQL and Sigma, covering 57 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.