VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances

A China-nexus cyber espionage group tracked as VerdantBamboo has deployed multiple malware variants targeting Linux systems and enterprise infrastructure.

• •VerdantBamboo exploited a local privilege escalation flaw in Egnyte Storage Sync to deploy the BRICKSTORM backdoor
• •The threat actor used BRICKSTORM's proxying capabilities and compromised credentials to access victim's Microsoft 365 environment
• •Two additional malware families (PLENET and AGENTPSD) were deployed to Synology NAS appliances over SSH
• •The initial compromise occurred through an MSP's breached pfSense firewall with a BSD variant of BRICKSTORM
• •PLENET is a .NET Core cross-platform backdoor supporting shell, remote execution, and C2 server switching; AGENTPSD is a Python-based reverse shell fallback