UNC5221 / VerdantBamboo: Brickstorm, Plenet & AgentPSD — 18-Month Dwell via M365 SOCKS5 Proxy

Legal Sector

Law firms targeted for privileged client communications, litigation strategy, M&A intel, and attorney-client privileged material with geopolitical value.

SaaS & Technology

SaaS providers and tech companies attacked for IP, source code, customer data, and as pivot points to downstream victims in shared infrastructure.

MSPs as Force Multipliers

Managed service providers compromised to gain trusted access to dozens of client environments simultaneously — one MSP breach can mean many victim organizations.

• 1~Sept 2023 (est.): VerdantBamboo compromises the victim's managed services provider via credential theft targeting the Egnyte Storage Sync service. Default service account egnyteservice had its password changed but still carried a sudoers misconfiguration allowing root tee writes. Brickstorm implanted at /usr/sbin/luserput.
• 22023–2024 (sustained): Actor uses Brickstorm's SOCKS5 proxying capabilities, running from the Egnyte system, to blend M365 authentication traffic with legitimate organizational activity. Conditional Access policies bypassed. Over one year of undetected M365 access follows.
• 32024 (mid-year est.): Victim removes the compromised SSL VPN. Rather than losing access, VerdantBamboo pivots — uses stolen admin credentials (which lacked MFA) to configure a custom web-based SSL VPN for re-entry. Deploys Brickstorm's FreeBSD variant on the victim's pfSense firewall at /usr/local/libexec/ipsec/blacklist.
• 4Late 2024: Plenet (.NET backdoor) deployed to Synology NAS via SSH. AgentPSD (Python reverse shell) deployed on the Egnyte system as fallback at /usr/local/bin/egnyte/egnyte_host_monitor_client. Actor now has three independent persistence mechanisms across different OS platforms.
• 5September 18–23, 2025: All VerdantBamboo C2 servers previously matching the Volexity Censys fingerprint disable their services on port 443 simultaneously — suggesting the actor detected or anticipated discovery. Infrastructure rotated.
• 6March 2025 (disclosed retrospectively): Volexity identifies the breach during an incident response engagement. Determines initial access occurred "at least 18 months" prior. Full malware analysis and IOC extraction completed.
• 7June 4, 2026: Volexity publishes full public disclosure. Google Cloud Threat Intelligence publishes corroborating analysis attributing Plenet/Grimbolt to the same actor cluster. BleepingComputer, The Hacker News report widely.

The initial foothold exploited a combination of credential theft and a privilege escalation path in Egnyte Storage Sync v13.12 and earlier. The attack vector was the victim's SSL VPN, which gave VerdantBamboo network-level access to the MSP's internal Egnyte system. From there, a misconfigured sudoers entry provided root filesystem write access.

• 1Credential theft: Credentials for the egnyteservice service account were stolen. This account had its password changed from the default but retained a sudoers misconfiguration present in Egnyte Storage Sync prior to v13.13.
• 2Sudoers exploitation: The misconfiguration allowed egnyteservice to execute /usr/bin/tee as root via sudo. Since tee writes stdin to a file, this provided arbitrary root-level filesystem write access.
• 3Brickstorm implantation: Using the root write path, VerdantBamboo wrote the Brickstorm Linux ELF binary to /usr/sbin/luserput and configured persistence via cron. The binary was 5.6 MB, obfuscated with gobfuscate.
• 4SSH access: SSH access to the Egnyte system was combined with the sudoers escalation to maintain persistent shell access alongside the Brickstorm C2 channel.

Brickstorm is VerdantBamboo's primary persistence and espionage tool. Initially written in Go and obfuscated with gobfuscate, the actor has since produced Rust variants — suggesting active development and investment in platform sustainability. Its core architecture uses WebSocket for C2, making it difficult to distinguish from legitimate encrypted web traffic.

Plenet — tracked by Google Threat Intelligence as "Grimbolt" — is a cross-platform .NET Core Native AOT backdoor offering equivalent functionality to Brickstorm on a different runtime. Volexity assesses VerdantBamboo chose .NET Core to provide an additional obfuscation layer and platform independence, deployed when the actor sought secondary persistence after Brickstorm was at risk.

AgentPSD is a simple but effective fallback persistence mechanism. If both Brickstorm and Plenet are neutralized, AgentPSD provides an independent HTTPS reverse shell connecting to a separate C2 domain. Its hard-coded parsing pattern makes it trivially identifiable in memory and traffic analysis.

VerdantBamboo's most sophisticated technique in this intrusion was not the malware itself — it was using Brickstorm's SOCKS5 proxy capability to route M365 authentication traffic through a trusted internal IP address, defeating Conditional Access policies designed to restrict cloud access to known corporate network ranges.

• 1Brickstorm as SOCKS5 proxy: With Brickstorm deployed on the Egnyte system (a trusted internal host), VerdantBamboo configured the malware's proxy capability to tunnel HTTPS requests through the internal network IP. From Microsoft's perspective, the authentication originated from a legitimate corporate IP address.
• 2Stolen credentials + proxy bypass: Credentials stolen from the Egnyte system (or obtained via network monitoring) were then used to authenticate to M365 via the SOCKS5 tunnel. Conditional Access policies requiring "compliant device" or "known network" checks were satisfied by the proxy routing.
• 3MSP breach via M365 access: Volexity assesses with medium confidence that VerdantBamboo's access to the victim's MSP was achieved partly through M365-hosted data obtained during the initial victim compromise — likely shared credentials, MSP admin access portals, or service principals stored in M365.
• 4pfSense firewall implant: After the original SSL VPN was removed, VerdantBamboo used stolen admin credentials lacking MFA to directly access and implant the pfSense firewall. Brickstorm's FreeBSD variant was deployed, modified /etc/rc.d/cron for persistence, giving the actor a second independent C2 channel.

VerdantBamboo's C2 infrastructure follows a consistent profile detectable via Censys and Shodan. Servers are Cloudflare-fronted, expose minimal services, and use OpenBSD SSH clients — a pattern unusual enough to fingerprint at scale. Volexity developed an active fingerprinting query that identified the full infrastructure, which then went dark on detection.

• 1Minimal service exposure: Servers expose 4 or fewer TCP ports. VerdantBamboo limits attack surface on C2 nodes to reduce exposure.
• 2Zero-length HTTP response: Port 443 returns a zero-length body — a Golang HTTP server default when no route matches. This is the primary distinguishing fingerprint.
• 3OpenBSD SSH client: C2 servers have OpenBSD-flavor SSH client banners present — unusual on Linux VPS infrastructure, suggesting a specific OS image preference or toolchain.
• 4Cloudflare certificates: All C2 domains resolved to Cloudflare IP ranges. Domain fronting provides both DDoS protection and IP attribution difficulty.
• 5Infrastructure shutdown response: Between September 18–23, 2025, all previously fingerprinted servers simultaneously disabled port 443 services — a coordinated response suggesting actor awareness of Volexity's research. This is a tell for a sophisticated, monitored operation.

The single most important lesson from this intrusion: EDR tools do not run on edge devices, firewalls, or NAS appliances. VerdantBamboo knew this. Start your investigation where no EDR exists.

• 1pfSense/FreeBSD firewalls: Search for unexpected files in /usr/local/libexec/, /usr/local/bin/, and /usr/sbin/. Run find / -newer /etc/passwd -type f 2>/dev/null to identify files modified after OS installation. Check /etc/rc.d/cron for unauthorized additions.
• 2NAS devices (Synology, QNAP): Review SSH auth logs for interactive sessions from unusual IPs. Check for new binaries in system paths. Synology: /usr/local/bin/, /usr/bin/. Review scheduled tasks and package manager for unauthorized installations.
• 3Linux storage sync systems (Egnyte, etc.): Audit sudoers configuration for NOPASSWD entries granting write utilities. Check service account home directories for unexpected files. Review cron jobs under all user contexts, not just root.
• 4Volexity scanner: Volexity and Google have released a shell script scanner for BRICKSTORM indicators on Linux and BSD systems. Run it across all appliances: bash brickstorm_scanner.sh — reference the Volexity GitHub threat-intel repository.
• 5Network traffic baseline deviation: Correlate edge device outbound connections against a 90-day baseline. Look for persistent low-volume HTTPS connections to Cloudflare-fronted IPs, especially on unusual ports or from processes that normally have no network activity.

• 1Export Unified Audit Log: In Microsoft Purview Compliance Portal, export all audit log entries for the past 90 days. Filter for authentication events, mail access, and file access from internal IP addresses. VerdantBamboo's proxy routes all traffic through a trusted internal IP, so geographic anomaly detection will not trigger.
• 2Identify credential reuse across services: The Egnyte service account likely had credentials reused or accessible to M365 service principals. Audit all service principals and app registrations for unusual permissions. Check last-used dates for dormant service principals — these may be attacker-maintained access paths.
• 3Conditional Access gap analysis: Map all Conditional Access policies. Identify which policies would pass authentication from a trusted internal IP. Specifically check whether any policies allow named locations (internal IP ranges) to bypass MFA — this is the bypass VerdantBamboo exploited.
• 4Email and SharePoint access patterns: Look for bulk email reads, unusual SharePoint download volumes, or forward/delegate rules created during the suspected intrusion window. These are primary intelligence collection behaviors for an espionage actor maintaining long-term access.
• 5MSP admin access review: If your organization uses an MSP, audit which MSP accounts have admin-level access to your M365 tenant. VerdantBamboo pivoted from the primary victim to the MSP's other clients via this trusted relationship. Review delegated admin privileges and partner relationships in Microsoft Partner Center.