VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
A China-nexus cyber espionage outfit has been seen targeting Linux computers with two different malware families dubbed PLENET (also known as GRIMBOLT) and AGENTPSD, as well as a BSD variation of a known backdoor called BRICKSTORM.
Volexity has linked the activity to a threat cluster it monitors called VerdantBamboo, which it claims overlaps with hacker groups including Warp Panda (CrowdStrike), UNC5221 (Google), and Clay Typhoon (Microsoft).
The cybersecurity firm claimed to have found the breach during an incident response engagement in September 2025, when it became clear that the adversary had penetrated the Egnyte Storage Sync system of an unidentified victim by using a local privilege escalation flaw to deploy BRICKSTORM. Storage Sync version 13.13, which was made available in...