VerdantBamboo Targets MSPs via BRICKSTORM Backdoor
🔗 https://cybersecurefox.com/en/verdantbamboo-brickstorm-msp-supply-chain
#VerdantBamboo #BRICKSTORM #PLENET #AGENTPSD #Egnyte #Storage #Sync
VerdantBamboo Targets MSPs via BRICKSTORM Backdoor
🔗 https://cybersecurefox.com/en/verdantbamboo-brickstorm-msp-supply-chain
#VerdantBamboo #BRICKSTORM #PLENET #AGENTPSD #Egnyte #Storage #Sync

In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The virtual machine was an Egnyte Storage Sync system, which is designed to facilitate sync local on-premise files with the cloud. Volexity discovered that instead of connecting to a domain affiliated with Egnyte, the appliance was connecting to a threat-actor-controlled domain behind Cloudflare IP addresses.