VerdantBamboo BRICKSTORM SSH Lateral Movement from Edge Appliance to Internal Host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects SSH, SFTP, or SCP connections originating from internal edge appliances such as pfSense firewalls or Synology NAS devices directed at internal network hosts. This activity is consistent with VerdantBamboo BRICKSTORM lateral movement, where compromised edge infrastructure is leveraged as a pivot point to gain access to the internal network.