Chinese APT VerdantBamboo Exploits Routers, Firewalls With BRICKSTORM Malware

Key Takeaways

• A sophisticated Chinese state-sponsored threat actor, VerdantBamboo (also known as WARP PANDA or UNC5221), has been leveraging a custom malware toolkit, including the BRICKSTORM remote access trojan, to compromise network appliances and firewalls.
• The group maintained undetected access to a victim’s corporate network for over 18 months, demonstrating advanced persistence and evasion techniques, including compromising a Managed Services Provider (MSP) to bypass direct security controls.
• VerdantBamboo exhibited remarkable resilience, re-establishing access to the victim’s network even after initial eviction by deploying new backdoors via stolen credentials and a custom VPN tunnel.
• Volexity researchers identified BRICKSTORM, PLENET, and AGENTPSD as key components of the APT’s toolkit, designed for stealthy long-term control and adaptable to various operating environments.
• A local privilege escalation flaw in Egnyte Storage Sync v13.13 and earlier was exploited, which has since been patched.

Chinese APT VerdantBamboo Employs BRICKSTORM Malware for Covert Operations

A Chinese state-linked hacking collective, identified as VerdantBamboo, has successfully maintained an unobserved presence within enterprise networks for over a year, deploying a bespoke malware suite to infiltrate firewalls, storage systems, and other critical network infrastructure without triggering security alerts. This group, also tracked as WARP PANDA and UNC5221, exhibits a degree of operational patience and technical sophistication that distinguishes it from many contemporary threat actors.

The extensive campaign came to light following the detection of anomalous network traffic originating from a Linux-based virtual machine within a customer’s environment. This device, an Egnyte Storage Sync appliance designed for cloud synchronization, was found to be surreptitiously communicating with an attacker-controlled domain. The malicious traffic was artfully concealed by leveraging Cloudflare IP addresses and routing DNS queries over HTTPS via Google’s public DNS server (8.8.8.8).

Analysts at Volexity, a prominent threat intelligence and incident response firm, pinpointed the primary malware implant facilitating this activity as BRICKSTORM. This remote access trojan has been under continuous development by VerdantBamboo. In a report shared with Cyber Security News (CSN), Volexity revealed that VerdantBamboo had sustained access to the victim network for a minimum of 18 months before its discovery. The full Volexity report can be found here.

The intrusion proved to be significantly more intricate than initially perceived. VerdantBamboo had not only compromised the victim’s internal systems but had also breached the organization’s Managed Services Provider (MSP). This secondary compromise granted the attackers access to critical credentials and internal infrastructure details, establishing a clandestine entry point into the victim’s environment that effectively circumvented conventional security protocols.

A particularly alarming aspect of this intrusion was VerdantBamboo’s ability to regain network access even after initial remediation efforts. Following the disconnection of compromised appliances, the attackers utilized stolen administrative credentials to log into the victim’s exposed firewall, establish their own VPN tunnel, and deploy a new backdoor onto a Synology NAS device. This sequence of events underscores the group’s adaptability and persistence, making incident recovery an arduous undertaking.

VerdantBamboo’s BRICKSTORM Malware and Toolkit

BRICKSTORM serves as VerdantBamboo’s primary mechanism for maintaining persistent control over infiltrated systems. This malware is specifically engineered to operate effectively in environments lacking robust security monitoring tools. Developed in Golang, BRICKSTORM features a modular architecture, with its functionalities compartmentalized into distinct packages. This design allows the threat actors to tailor each deployment to the specific target device, enhancing its efficacy and evasiveness.

On the compromised Egnyte appliance, BRICKSTORM was located in the /usr/sbin/ directory and executed manually by the threat actor as needed, exploiting a misconfigured sudo rule to escalate privileges. A variant of the same malware was discovered on the MSP’s pfSense firewall, adapted for FreeBSD. This version was obfuscated using a tool named gobfuscate and configured for automatic execution via a modified cron startup file.

Beyond BRICKSTORM, Volexity also identified two previously uncataloged malware families within VerdantBamboo’s arsenal: PLENET and AGENTPSD. PLENET is a cross-platform backdoor compiled from .NET Core, utilizing Native AOT to complicate analysis. AGENTPSD is a lightweight Python-based reverse shell, designed as a contingency mechanism should BRICKSTORM become inoperable.

Infrastructure Takedown and Detection Guidance

Volexity successfully tracked VerdantBamboo’s command-and-control (C2) servers by developing a unique fingerprinting query on the Censys platform. This query identified hosts running minimal services on port 443, utilizing Cloudflare certificates, and employing OpenBSD-based SSH clients. Within days of this fingerprint’s development in September 2025, all identified matching servers ceased operation, indicating that the threat actor had become aware of the ongoing investigation and adjusted their tactics to evade further detection.

The local privilege escalation vulnerability within the Egnyte Storage Sync system was reported to Egnyte and has since been addressed in Storage Sync v13.13.

What You Should Do

• Ensure all edge appliances, including firewalls, NAS devices, and storage sync systems, are not directly exposed to the internet without robust multi-factor authentication (MFA) protections.
• Conduct regular audits of accounts with sudo privileges to identify and rectify any unintended permission chains or misconfigurations.
• For systems incapable of running Endpoint Detection and Response (EDR) agents, implement compensating controls such as continuous network traffic monitoring, file integrity checking, and stringent access policies. These measures are crucial for detecting the subtle, long-term compromises characteristic of sophisticated APTs like VerdantBamboo.
• Review and implement the Indicators of Compromise (IoCs) provided by Volexity into your security monitoring and detection systems.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.