VerdantBamboo BRICKSTORM SSH Tunneling from Edge Appliances to Internal Hosts

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•6

Detects anomalous SSH connections originating from internal network appliances or DMZ-segment devices (e.g., storage, firewalls) to multiple internal network hosts. This behavior is indicative of lateral movement or SSH tunneling as observed in the VerdantBamboo BRICKSTORM campaign, where edge devices are leveraged as pivot points.