Volexity Details VerdantBamboo Breach Using BRICKSTORM on Edge Appliances
Summary
Volexity details an 18-month VerdantBamboo intrusion involving compromised appliances, BRICKSTORM and two other backdoors, stolen credentials, and access through an MSP. Egnyte fixed a privilege escalation issue in Storage Sync v13.13.
Key points
- Volexity linked the activity to VerdantBamboo, also tracked as WARP PANDA and UNC5221, and assessed that key appliance compromises had persisted for at least 18 months.
- The actor accessed an Egnyte Storage Sync appliance using stolen credentials over SSH, then abused its sudo configuration to write files as root and deploy BRICKSTORM.
- The actor used compromised MSP systems and victim network devices, including a pfSense firewall, to regain access and move into the victim’s network.
- Stolen administrative credentials and an internet-exposed firewall management interface enabled the actor to configure SSL VPN access and deploy PLENET to a Synology NAS.
- Volexity identified BRICKSTORM alongside PLENET, a .NET Native AOT backdoor, and AGENTPSD, a Python reverse shell assessed as a fallback implant.
- The actor used compromised edge appliances as proxies to access Microsoft 365 and evade Conditional Access policies; Volexity noted these devices lacked effective EDR coverage.
- Egnyte fixed the reported local privilege escalation issue in Storage Sync v13.13.
Article Details
- Attack Vectors
- Volexity assesses with medium confidence that the victim organization was initially compromised through its breached MSP. The attacker obtained credentials for an appliance account whose default password had been changed by the MSP.
- Valid credentials were used for SSH access to an appliance through addresses assigned by the victim's web-based SSL VPN. Volexity surmises that compromised local accounts without MFA enabled the original VPN access, but retained logs could not establish this.
- A sudo configuration allowed an unprivileged appliance account to execute tee as root, enabling arbitrary privileged file writes and execution of a backdoor through a temporary cron entry.
- After initial remediation, an Internet-exposed firewall administrative interface was accessed using stolen administrative credentials without MFA. The attacker configured SSL VPN access and used it to re-enter the network.
- Administrative access to a NAS web interface was used to enable SSH and deploy another backdoor.
- Backdoors on appliances without EDR coverage provided proxy connections into the victim's cloud environment. Volexity assesses with high confidence that this helped evade Conditional Access policies and blend with legitimate traffic.
- Defensive Notes
- The reported local privilege escalation issue was fixed in Storage Sync v13.13.
- Initial remediation included isolating and taking the compromised appliance offline and retiring the existing SSL VPN device, but the attacker subsequently regained access through a separate firewall.
- After the original VPN device was retired, the firewall's administrative interface became accessible over the Internet; its administrative credentials were not protected by MFA.
- Insufficient VPN log retention prevented investigators from determining how the original VPN access was obtained.
- Monitoring proprietary appliances can be difficult or impossible where owners lack root access and the devices cannot support EDR.
- The published infrastructure fingerprint did not have a 100-percent true-positive rate. Servers previously matching it subsequently disabled their port 443 services.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 58d4eccc982c9e9b1b98aa62c514e53a | MD5 of the BRICKSTORM sample named luserput (sbin) on the compromised Storage Sync appliance. |
| MD5 | 84ad78b2bab946c3677fdc28ebd8a774 | MD5 of the FreeBSD-compatible BRICKSTORM sample named blacklist on the MSP's pfSense firewall. |
| MD5 | 95dc2289427ed29b8b996d0e3d1b78cb | MD5 of the PLENET sample named ovs-dbctl deployed to the victim's Synology NAS. |
| MD5 | 98ee964edeb5a988c3bba8ea1e57fe0e | MD5 of the AGENTPSD sample named egnyte_host_monitor_client. |
| SHA1 | 681075027553546c119ec447eb8df84633dcffce | SHA1 of the FreeBSD-compatible BRICKSTORM sample named blacklist on the MSP's pfSense firewall. |
| SHA1 | e952c18272efa1c3d73d0a5381bcf443c02743fe | SHA1 of the AGENTPSD sample named egnyte_host_monitor_client. |
| SHA1 | f4d77958a12a0778283d3e679b24b18f82e332c4 | SHA1 of the BRICKSTORM sample named luserput (sbin) on the compromised Storage Sync appliance. |
| SHA1 | f8d93c1769e877aae7e7d5c289a467b5ae371c7a | SHA1 of the PLENET sample named ovs-dbctl deployed to the victim's Synology NAS. |
| SHA256 | 40d264cf9c73923932c3dfd52d20f46ff602be3fea8dc6ecc71aca46e6067bf5 | SHA256 of the BRICKSTORM sample named luserput (sbin) on the compromised Storage Sync appliance. |
| SHA256 | e28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0 | HTTP banner hash used in Volexity's Censys query to identify possible BRICKSTORM C2 servers; the combined fingerprint was not entirely specific to malicious servers. |
| SHA256 | eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e | SHA256 of the PLENET sample named ovs-dbctl deployed to the victim's Synology NAS. |
| SHA256 | ee41e06ed96182ce80cd4544a6abd5d7719c4a5c0e5ddb266a83842d39b99b0a | SHA256 of the AGENTPSD sample named egnyte_host_monitor_client. |
| SHA256 | f70abe93112637d3ec2f6c5e058ccac0307ebf63e496f38588cbfc17a8f8a264 | SHA256 of the FreeBSD-compatible BRICKSTORM sample named blacklist on the MSP's pfSense firewall. |
MITRE ATT&CK
T1021.004 · SSHVerdantBamboo used SSH to access the Storage Sync appliance and later the Synology NAS to deploy backdoors.T1027 · Obfuscated Files or InformationThe FreeBSD BRICKSTORM sample was protected with gobfuscate, and AGENTPSD stored its C2 address in an encoded buffer.T1027.002 · Software PackingThe analyzed PLENET sample was packed with UPX.T1037.004 · RC ScriptsOn the MSP's pfSense firewall, VerdantBamboo modified /etc/rc.d/cron to execute the BRICKSTORM implant named blacklist.T1053.003 · CronVerdantBamboo used a temporary /etc/cron.d/ssync entry to launch BRICKSTORM and added a monthly root cron entry for the fallback AGENTPSD implant.T1059.004 · Unix ShellAGENTPSD executes received builtin command text through the native shell, and BRICKSTORM and PLENET support remote shell execution.T1070.004 · File DeletionVerdantBamboo removed its temporary file from /etc/cron.d/ after it executed the BRICKSTORM launcher.T1071.001 · Web ProtocolsAGENTPSD exchanges commands and shell output through HTTPS POST requests; BRICKSTORM and PLENET use WebSocket connections for C2.T1078 · Valid AccountsVerdantBamboo used compromised credentials to access the victim's M365 environment and stolen administrative credentials to access its firewall and NAS.T1078.003 · Local AccountsVerdantBamboo authenticated over SSH using the appliance's local egnyteservice account, whose password had been changed by the MSP.T1082 · System Information DiscoveryAGENTPSD constructs a client identification string containing the hostname and hexadecimal machine UUID.T1083 · File and Directory DiscoveryThe analyzed BRICKSTORM variants include a web task that exposes filesystem information.T1090.001 · Internal ProxyVerdantBamboo used implant proxy capabilities on compromised internal appliances to access M365 through the victim's network and evade Conditional Access restrictions.T1133 · External Remote ServicesVerdantBamboo accessed the network through web-based SSL VPN connections and configured a new SSL VPN on the firewall after remediation.T1140 · Deobfuscate/Decode Files or InformationAGENTPSD decodes its embedded C2 address using Base64 while skipping the first buffer character and Base64-decodes commands from server responses.T1199 · Trusted RelationshipVolexity assesses with medium confidence that compromise of the victim's MSP provided the route into the victim organization.T1548.003 · Sudo and Sudo CachingThe egnyteservice sudo configuration permitted tee to run as root, allowing VerdantBamboo to write privileged files.
Threat Actors
UNC5221Listed by the article as another tracking name associated with VerdantBamboo, also identified as WARP PANDA.VerdantBambooVolexity's name for the Chinese threat actor responsible for the appliance and MSP compromises; the article associates this actor with WARP PANDA and UNC5221.WARP PANDAListed by the article as another name associated with the actor Volexity tracks as VerdantBamboo, also identified as UNC5221.
Malware
AGENTPSDAGENTPSD, a malware family written in Python that was deployed to Linux systems.BRICKSTORMThe suspicious connections observed were the result of a malware implant known as BRICKSTORM (described in public reporting, including posts by CISA, Google Cloud and NVISO).GRIMBOLTThis malware was referred to as “GRIMBOLT” by Google Cloud.PLENETPLENET, a malware family written in .NET Core and compiled to native code using the Native AOT features added in .NET 7.
Vendors
CloudflareVolexity discovered that instead of connecting to a domain affiliated with Egnyte, the appliance was connecting to a threat-actor-controlled domain behind Cloudflare IP addresses.EgnyteThe virtual machine was an Egnyte Storage Sync system, which is designed to facilitate syncing local on-premise files with the cloud.GoogleThe appliance was also making TLS connections to one of Google’s public DNS servers (8.8.8.8).SynologyThat access was then used to further connect to systems internally and deploy additional custom malware to a Synology NAS appliance.VolexityIn September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network.
Products
Egnyte Storage SyncThe virtual machine was an Egnyte Storage Sync system, which is designed to facilitate syncing local on-premise files with the cloud.ESXiHowever, the threat actor was not observed SSH’ing into, or otherwise installing malware on, any ESXi or vCenter systems, despite public reporting indicating this is something the threat actor frequently does.FreeBSDpfSense is a popular open-source firewall that runs on the FreeBSD operating system.GroupWiseThis sample was installed on a legacy Linux-based GroupWise server used for archived email messages, which had since been fully shutdown but was still accessible for the investigation.LinuxIn September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network.Microsoft 365deployed on the Storage Sync system, along with compromised credentials, to access the victim’s Microsoft 365 (M365) environment.pfSenseAfter a brief investigation of the MSP’s network, Volexity found that the MSP’s pfSense firewall had been compromised by VerdantBamboo with a BSD variant of BRICKSTORM.vCenterHowever, the threat actor was not observed SSH’ing into, or otherwise installing malware on, any ESXi or vCenter systems, despite public reporting indicating this is something the threat actor frequently does.vSphereThe BRICKSTORM malware family is publicly documented, with variants dedicated to various appliances, including vSphere infrastructure.
Tools
Censys PlatformOn September 6, 2025, analyzing common features of these resolving IP addresses led to the development of the following Censys Platform query to fingerprint BRICKSTORM C2 servers:ghidra-nativeaotThe process of mapping the hydrated data was achieved using the ghidra-nativeaot plugin.gobfuscateThe BRICKSTORM sample found on the MSP’s pfSense firewall appliance is notable as it is a FreeBSD compatible variant of the backdoor and protected with the gobfuscate binary obfuscator.PyInstallerThis malware was compiled to a binary using PyInstaller.UPXThis sample is packed with UPX. Once unpacked, the first obstacle was Native AOT’s data “hydration” feature.Volexity Surge Collect ProVolexity obtained access to the Synology system and used Volexity Surge Collect Pro to collect memory and selective files for analysis.Volexity Volcano ServerThe data collected was then processed with Volexity Volcano Server.