Chinese APT VerdantBamboo Uses BRICKSTORM Malware to Compromise

A Chinese state-linked hacking group has maintained an undetected presence within corporate networks for more than a year. The attackers deployed a custom malware toolkit to compromise firewalls, storage systems, and other network appliances without ever triggering an alarm.

The group, tracked as VerdantBamboo, has shown a level of patience and technical precision that sets it apart from most threat actors operating today.

The campaign came to light after suspicious network traffic was spotted coming from a Linux-based virtual machine on a customer’s network.

The device was an Egnyte Storage Sync appliance, designed to sync local files to the cloud.

Instead of connecting to Egnyte’s own infrastructure, it was quietly beaconing out to a domain controlled by the attackers, hiding behind Cloudflare IP addresses and using Google’s public DNS server at 8.8.8.8 to resolve queries over HTTPS, a technique that neatly disguised the malicious traffic.

Analysts at Volexity, a threat intelligence and incident response firm, identified the malware implant responsible for the activity as BRICKSTORM, a remote access trojan the group has been actively evolving. 

Volexity said in a report shared with Cyber Security News (CSN) that VerdantBamboo, also tracked as WARP PANDA and UNC5221, had maintained access to the victim network for at least 18 months before being discovered.

The attack turned out to be far more layered than it first appeared. VerdantBamboo had not only compromised the victim’s own systems but had also breached the organization’s Managed Services Provider.

From there, it gained access to credentials and internal infrastructure details that gave it a foothold into the victim environment through a path that bypassed standard security controls entirely.

What makes this intrusion especially notable is how VerdantBamboo re-entered the network even after being evicted.

Once the compromised appliances were taken offline, the attackers used stolen admin credentials to log into the victim’s exposed firewall, set up their own VPN tunnel, and pushed a new backdoor onto a Synology NAS device. The attack chain showed a resilience and adaptability that made recovery a significant challenge.

Chinese APT VerdantBamboo Uses BRICKSTORM Malware

BRICKSTORM is VerdantBamboo’s primary tool for maintaining control over compromised systems, and it has been deliberately crafted to thrive in environments where traditional security monitoring tools are absent.

The malware is built in Golang with a modular architecture, and its functionality is divided into separate packages that allow developers to customize each deployment for the specific target device.

On the Egnyte appliance, BRICKSTORM was placed in the /usr/sbin/ directory and launched manually by the threat actor each time it was needed, exploiting a misconfigured sudo rule to gain elevated privileges.

The same malware was found on the MSP’s pfSense firewall in a FreeBSD-compatible variant, obfuscated with a tool called gobfuscate and set to run automatically through a modified cron startup file.

Alongside BRICKSTORM, Volexity also identified two previously undocumented malware families: PLENET, a cross-platform backdoor compiled from .NET Core using Native AOT to make analysis harder, and AGENTPSD, a lightweight Python reverse shell designed as a fallback if BRICKSTORM stopped working.

Infrastructure Takedown and Detection Guidance

Volexity tracked VerdantBamboo’s command-and-control servers using a fingerprinting query on the Censys platform, identifying hosts running minimal services on port 443 with Cloudflare certificates and OpenBSD-based SSH clients.

Within days of that fingerprint being developed in September 2025, all the matching servers went dark, suggesting the threat actor had become aware of the investigation and shifted tactics to avoid detection.

The local privilege escalation flaw in the Egnyte Storage Sync system was reported to Egnyte and patched in Storage Sync v13.13.

Organizations running edge appliances, including firewalls, NAS devices, and storage sync systems, should ensure these systems are never directly accessible from the internet without MFA protections in place.

Accounts with sudo privileges should be audited for unintended permission chains. Systems that cannot run EDR agents need compensating controls such as network traffic monitoring, file integrity checking, and strict access policies to detect the quiet, long-term compromise that VerdantBamboo specializes in.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.