A sophisticated Chinese threat actor known as VerdantBamboo has been caught exploiting network edge appliances to infiltrate enterprise networks and access Microsoft 365 environments.
Discovered during an incident response engagement by Volexity in September 2025, the campaign highlights a growing trend of targeting devices that traditionally lack Endpoint Detection and Response (EDR) coverage.
The attackers compromised an Egnyte Storage Sync virtual machine. They used it as a proxy to blend in with legitimate network traffic.
This proxying capability allowed them to bypass Conditional Access policies designed to restrict unauthorized logins effectively.
Further investigation revealed a deeply entrenched operation with an alarming dwell time of at least 18 months. VerdantBamboo, also tracked by security researchers as WARP PANDA or UNC5221, did not just target the primary victim organization.
They also successfully compromised the victim’svictim’s Managed Service Provider (MSP). By breaching pfSense’s firewall, the attackers established a reliable beachhead.
This allowed them to steal administrative credentials, map infrastructure details, and pivot back into the victim’s network even after initial remediation efforts.
VerdantBamboo Targets Network Appliances
To maintain this long-term access, VerdantBamboo deployed a sophisticated mix of primary and fallback implants specifically tailored for Linux and BSD operating systems.
The threat actor demonstrated excellent operational security by customizing malware for specific devices.
They also deliberately used separate command-and-control domains for their fallback tools, ensuring that if defenders blocked the primary infection, the secondary backdoors would remain completely hidden.
The attackers relied heavily on exploiting misconfigurations and stolen credentials to push their implants.
On the Egnyte Storage Sync system, VerdantBamboo discovered an inadvertent local privilege escalation vulnerability within the device’s sudo configuration.
This critical flaw allowed their unprivileged service account to run specific commands with root privileges. By exploiting this, the threat actor could write files to arbitrary locations on the system, dropping the BRICKSTORM payload directly into restricted directories and launching it via scheduled tasks.
According to Volexity research, the compromise of the MSP’sMSP’s pfSense firewall proved equally damaging. pfSense runs on FreeBSD, and VerdantBamboo came prepared with a specialized, obfuscated variant of BRICKSTORM designed specifically for that environment.
They maintained persistence by modifying the system cron files, ensuring their backdoor would run consistently.
This level of preparation demonstrates a deep understanding of proprietary network appliances and the underlying operating systems that power them.
When incident responders finally isolated the Egnyte system and disabled the compromised VPN, VerdantBamboo shifted its focus.
Using stolen administrative credentials that completely lacked multi-factor authentication, they logged into an exposed Synology NAS appliance on the victim’svictim’s network.
They quickly enabled SSH access and deployed the highly evasive PLENET backdoor to regain their foothold.
During the investigation, security teams managed to fingerprint the attacker’sattacker’s infrastructure by analyzing the BRICKSTORM command-and-control servers.
They discovered that the servers consistently used Cloudflare IP addresses and presented distinct TLS certificates.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
