# VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign — MSP Supply-Chain Compromise of Edge Appliances with 18-Month Dwell

> China-nexus espionage actor VerdantBamboo (UNC5221 / WARP PANDA) maintained access to a U.S. victim network for at least 18 months by compromising the victim's MSP and abusing EDR-less edge appliances. The actor planted BRICKSTORM (Go/Rust/BSD variants) on a pfSense firewall and an Egnyte Storage Sync Linux VM, deployed the AGENTPSD Python reverse shell as fallback, and later added the PLENET (Grimbolt) .NET backdoor on a Synology NAS — using BRICKSTORM SOCKS proxying plus stolen credentials to reach the victim's Microsoft 365 tenant and bypass Conditional Access.

- **Published:** 2026-06-07T00:00:00Z
- **Last reviewed:** 2026-06-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0706
- **ID:** TL-2026-0706
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** VerdantBamboo (China)
- **Detections:** 9 · **IOCs:** 57 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Volexity, in an incident response engagement that began in September 2025, uncovered a long-running intrusion by the China-nexus actor VerdantBamboo (also tracked as UNC5221 and WARP PANDA). The actor had maintained covert access to the victim environment for at least 18 months, deliberately targeting network edge and infrastructure appliances — firewalls, NAS, and storage-sync VMs — that fall outside typical EDR coverage.

INITIAL ACCESS & FOOTHOLD: The earliest confirmed foothold was a Linux Egnyte Storage Sync VM, accessed via valid SSH credentials for the 'egnyteservice' account, reached through the victim's web SSL VPN. A local privilege escalation in Egnyte Storage Sync (sudoers Cmnd_Alias EGNYTEAPPS granting PASSWD-less use of /usr/bin/tee to the unprivileged egnyteservice account) allowed arbitrary file writes anywhere on the filesystem — fixed in Storage Sync v13.13. The actor also compromised the victim's Managed Service Provider (MSP) and planted a BSD-compiled BRICKSTORM variant on the MSP's pfSense firewall, providing a resilient re-entry point.

MALWARE — BRICKSTORM: A modular Golang RAT (with later Rust variants and a FreeBSD build for pfSense) built around the 'wssoft' package namespace (wssoft.core for C2/task dispatch, wssoft.libs for local ops). It communicates over WebSocket and supports pluggable task extensions: 'command' (shell), 'socks' (SOCKS5 proxy), and 'web' (filesystem interface). Instances are customized per victim with only the needed extensions; the BSD variant was obfuscated with gobfuscate. On the Storage Sync host it was placed at /usr/sbin/ (luserput); on the pfSense firewall at /usr/local/libexec/ipsec/blacklist. C2 domains are customized per victim and front through Cloudflare.

MALWARE — AGENTPSD: A PyInstaller-compiled Python reverse shell deployed as /usr/local/bin/egnyte/egnyte_host_monitor_client, assessed (medium confidence) as a fallback. It beacons over HTTPS POST with Content-Type application/octet-stream and a 'sec-fetch-tag' header carrying Base64-encoded system info, identifies clients as root_<hostname>_<hex machine UUID>, uses the hardcoded delimiter PoRaSGw3jzQ8YSaz, Base64 command encoding (ignoring the first character), and supports interval/during/builtin command types. Persistence was a crontab entry firing on the 15th at 14:20. Its C2 domain was registered but never resolved during the investigation.

MALWARE — PLENET (Google: Grimbolt): A cross-platform .NET Core backdoor compiled with Native AOT and packed with UPX, deployed to a Linux-based Synology NAS as ovs-dbctl. It uses WebSocket C2 multiplexed via the Nerdbank.Streams library and native .NET Task async, and supports interactive shell, remote command execution, file manipulation, and live C2 server switching. The .NET/AOT choice is assessed (medium confidence) as an anti-analysis measure.

LATERAL MOVEMENT & OBJECTIVE: BRICKSTORM's SOCKS proxy let the actor tunnel through trusted internal infrastructure to access the victim's Microsoft 365 environment with stolen credentials, blending with legitimate traffic and bypassing Conditional Access IP restrictions. A SLAYSTYLE webshell and additional BRICKSTORM samples were also observed. After Volexity's initial remediation, the actor regained access within days via stolen, MFA-less firewall administrative credentials and an actor-enabled SSL VPN configuration — underscoring incomplete eradication of the MSP foothold.

INFRASTRUCTURE: On 2025-09-06 Volexity built a Censys fingerprint for BRICKSTORM C2 (minimal HTTP response on 443, OpenBSD SSH on 22, Cloudflare-issued certificate, low service count); between 2025-09-18 and 2025-09-23 every matching server disabled its port 443 service, and on 2025-09-24 Google Cloud published its own BRICKSTORM analysis. VerdantBamboo demonstrates strong OPSEC: limited per-victim infrastructure, per-device implant naming/persistence, and a focus on appliances lacking endpoint telemetry.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1505 Server Software Component
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1087 Account Discovery
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1071 Application Layer Protocol
- T1090 Proxy
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1530 Data from Cloud Storage

## Sources

- [VerdantBamboo: Just Another BRICKSTORM in the Firewall](https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/)
- [Chinese APT deploys new malware to keep access to hacked networks](https://www.bleepingcomputer.com/news/security/chinese-apt-deploys-new-malware-to-keep-access-to-hacked-networks/)
- [Volexity Threat Intel — VerdantBamboo IOCs (iocs.csv)](https://github.com/volexity/threat-intel/tree/main/2026/2026-06-04%20VerdantBamboo)
- [Volexity VerdantBamboo YARA rules (rules.yar)](https://raw.githubusercontent.com/volexity/threat-intel/main/2026/2026-06-04%20VerdantBamboo/rules.yar)
- [Google Cloud (Mandiant) — BRICKSTORM analysis](https://cloud.google.com/blog/topics/threat-intelligence)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0706