CyberSecureFox 
VerdantBamboo Targets MSPs via BRICKSTORM Backdoor
🔗 https://cybersecurefox.com/en/verdantbamboo-brickstorm-msp-supply-chain
#VerdantBamboo #BRICKSTORM #PLENET #AGENTPSD #Egnyte #Storage #Sync
Anto 🕵️👾BRICKSTORM case from Volexity: a clear reminder that edge appliances, MSP access and trusted network paths can become long-term blind spots for cloud compromise.
https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/
#ThreatIntelligence #CyberSecurity #APT #BRICKSTORM #Microsoft365 #CloudSecurity #DFIR
VerdantBamboo: Just Another BRICKSTORM in the Firewall
In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The virtual machine was an Egnyte Storage Sync system, which is designed to facilitate sync local on-premise files with the cloud. Volexity discovered that instead of connecting to a domain affiliated with Egnyte, the appliance was connecting to a threat-actor-controlled domain behind Cloudflare IP addresses.
(in)sicurezza digitaleVerdantBamboo (UNC5221): il gruppo APT cinese che resta invisibile per 18 mesi con tre backdoor inedite
Volexity ricostruisce un'intrusione durata 18 mesi da parte del gruppo APT cinese VerdantBamboo/UNC5221. Tre backdoor inedite — BRICKSTORM, PLENET e AGENTPSD — deployate su appliance senza EDR per bypassare le Conditional Access Policy di Microsoft 365. Il gruppo è tornato pochi giorni dopo la remediation.
The New OilChinese #APT deploys new #malware to keep access to hacked networks
#China #cybersecurity #UNC5221 #Brickstorm #Planet #AgentPSD #VerdantBamboo
Global Feed🔥 TRENDING
📢 BRICKSTORM-Malware: Chinesische Hacker bleiben 18 Monate unentdeckt - Börse Express
#Brickstorm-malware #Chinesische #Hacker #Monate #GlobalFeed #News #DE
*Automatisch ge...
The Threat CodexVerdantBamboo: Just Another BRICKSTORM in the Firewall
#VerdantBamboo #Plenet #AGENTPSD #BRICKSTORM
https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/
#VerdantBamboo #Plenet #AGENTPSD #BRICKSTORM
https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/
VerdantBamboo: Just Another BRICKSTORM in the Firewall
In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The virtual machine was an Egnyte Storage Sync system, which is designed to facilitate sync local on-premise files with the cloud. Volexity discovered that instead of connecting to a domain affiliated with Egnyte, the appliance was connecting to a threat-actor-controlled domain behind Cloudflare IP addresses.
Daniel MarshUNC5221, a Chinese APT, isn't relying on one backdoor. They're building an "access portfolio" with new malware like Brickstorm and Plenet, exploiting zero-days and edge devices to maintain persistent access for over 18 months. This multi-malware strategy allows re-breaches, turning incident response into a resource drain. Discover their tactics and the real impact.
#cybersecurity #unc5221 #brickstorm
🤖 This post was AI-generated.
Volexity 
@volexity has published details from an incident response engagement in September 2025 involving multiple #BRICKSTORM variants deployed by a threat actor that Volexity tracks as VerdantBamboo. This case involved the breach of the victim organization’s MSP and multiple malware implants found on firewalls, cloud storage sync devices & NAS appliances. VerdantBamboo used a #0day privilege escalation exploit in the process and was also observed using administrative access to the victim organization's firewall to enable a custom VPN.
For more details on how the incident unfolded, the malware used by the threat actor, and the end goal of the intrusion, check out the full blog post: https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/
Analyst207VMware vSphere Ecosystem Targeted by BRICKSTORM Malware Attacks
Imagine an attacker sneaking past your trusted operating system and into the hidden infrastructure that powers your virtual machines - that's the risk posed by BRICKSTORM malware, which targets the VMware vSphere ecosystem. This stealthy threat allows adversaries to operate undetected, evading traditional endpoint tools by establishing…
https://osintsights.com/vmware-vsphere-ecosystem-targeted-by-brickstorm-malware-attacks
Threat Intelligence vSphere and BRICKSTORM Malware: A Defender's Guide
#BRICKSTORM
https://cloud.google.com/blog/topics/threat-intelligence/vsphere-brickstorm-defender-guide/
#BRICKSTORM
https://cloud.google.com/blog/topics/threat-intelligence/vsphere-brickstorm-defender-guide/
