VerdantBamboo: Just Another BRICKSTORM in the Firewall

### Executive summary Volexity investigated a long-term intrusion by VerdantBamboo (WARP PANDA/UNC5221) that compromised an Egnyte Storage Sync VM, an MSP pfSense firewall, and a Synology NAS, deploying BRICKSTORM (primary RAT), PLENET (.NET Native AOT backdoor), and AGENTPSD (Python reverse shell). The actor used credential theft and appliance-based proxying to access Microsoft 365 and internal resources while evading conditional access and EDR, with compromises persisting for at least 18 months and evidence of MSP compromise enabling lateral access.