VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances

Volexity attributes a prolonged China-nexus espionage campaign (VerdantBamboo) that compromised an organization and its MSP by exploiting appliance vulnerabilities and using stolen credentials to deploy a BSD variant of the BRICKSTORM backdoor plus PLENET/GRIMBOLT and AGENTPSD on Linux and NAS devices; the actor leveraged proxying and living-off-the-land techniques to access M365 and maintain persistence across devices, with evidence of tailored implants, operational security, and long dwell time.