Executive Summary
Volexity has identified an 18-month espionage campaign by VerdantBamboo (also known as WARP PANDA or UNC5221) targeting edge appliances including Egnyte Storage Sync, pfSense firewalls, and Synology NAS devices. By compromising these systems, which typically lack Endpoint Detection and Response (EDR) coverage, the actor established proxy connections into Microsoft 365 environments to blend with legitimate traffic and bypass Conditional Access policies.
The attack chain involves leveraging stolen credentials—often obtained through the compromise of a victim's Managed Service Provider (MSP)—and exploiting local privilege escalation vulnerabilities. The actor utilized a diverse malware toolkit, including the BRICKSTORM Golang/Rust RAT, the .NET Native AOT-compiled PLENET backdoor, and a Python-based fallback shell named AGENTPSD. This campaign highlights a strategic focus on proprietary Linux-based and BSD-based appliances to ensure long-term, stealthy network persistence.
Following public disclosures, the actor was observed taking infrastructure offline and rotating C2 services, indicating high operational security awareness. Organizations using edge storage or firewall appliances should audit these devices for unauthorized root access and ensure multi-factor authentication (MFA) is enforced for all administrative and VPN interfaces.