--- analysis: This is a hunt because a single 'admin login' alert is too noisy for storage appliances. We combine scoping of specific vulnerable appliance types with a stack-count of source IPs and identifying specific web management URIs to differentiate actor behavior from MSP maintenance. blind_spots: - id: missing-appliance-telemetry question: whether commands were executed on the appliance after the web login requires: EDR agent or Syslog from the storage appliance risk: Without process telemetry from the NAS itself, we rely on HTTP logs to see the activity, which may miss command execution if it occurs outside the web interface. stage: lateral-movement-and-nas-compromise - id: vpn-source-anonymity question: which external actor is tied to an internal IP in the sign-in logs requires: VPN session logs correlated with internal IP assignments risk: If hb_auth_signin logs only the internal VPN IP, we cannot distinguish between a compromised employee and a compromised MSP user without joining to external VPN gateway logs. stage: initial-access-stolen-appliance-credentials coverage: - stage: initial-access-stolen-appliance-credentials status: covered steps: - rare-admin-auth-sources - triage-appliance-access - stage: lateral-movement-and-nas-compromise status: covered steps: - appliance-management-web-access - triage-appliance-access - reason: 'Belongs to another part of the ''VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall'' series.' stage: local-privilege-escalation-sudo-tee status: out_of_scope - reason: 'Belongs to another part of the ''VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall'' series.' stage: persistence-via-scheduled-cron status: out_of_scope - reason: 'Belongs to another part of the ''VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall'' series.' stage: malware-deployment-brickstorm-agentpsd status: out_of_scope - reason: 'Belongs to another part of the ''VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall'' series.' stage: c2-proxying-via-doh-and-cloudflare status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: VerdantBamboo targets edge appliances as a bridge into cloud and internal environments, using stolen credentials to bypass MFA. A negative result across these critical systems validates the security of the administrative plane. methodology: model-assisted trigger: intel-report hypothesis: An adversary has used stolen administrative or service account credentials to access edge appliances via VPN or SSH, subsequently using web-based management interfaces to pivot further or deploy persistence. labels: - hunt - attack.t1078 - attack.t1133 - attack.t1059 - attack.t1090.003 - attack.t1505.003 name: VerdantBamboo Stolen Credential and Pivot Hunt parameters: lookback_days: default: '14' description: Days of history to examine for authentication and web activity. from: kind: manual observed: '2026-06-04' ref: standard-lookback type: number scope_hosts: default: [] description: 'Optional: List of storage appliance hostnames to focus the hunt; leave empty for whole estate.' from: kind: manual observed: '2026-06-04' ref: analyst-scoping type: list[host] target_users: default: - egnyteservice - admin - root description: Administrative and service accounts targeted in this campaign. from: kind: article observed: '2026-06-04' ref: Volexity VERDANTBAMBOO type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Start by identifying all Egnyte Storage Sync and Synology NAS systems using software inventory. Focus on administrative subnets and systems where administrative interfaces are exposed to the VPN network or public internet. references: - name: "Volexity \u2014 VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall" url: https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/ related: - hunt: verdantbamboo-malware-persistence reason: Persistence via cron and BRICKSTORM binary deployment requires file and scheduled task surfaces which are covered in a companion hunt. relation: out-of-scope-alternative - hunt: verdantbamboo-edge-appliance-post-exploitation relation: follows scenario: stages: - name: Access via Stolen Appliance Credentials observables: - egnyteservice - SSH logins to Egnyte Storage Sync - VPN IP address source for administrative logins slug: initial-access-stolen-appliance-credentials tactic: initial-access techniques: - T1078 - T1133 - name: Local Privilege Escalation via Sudo Tee observables: - sudo /usr/bin/tee - /usr/local/bin/egnyte/rsync_data_migration.sh - /usr/bin/systemctl restart networking slug: local-privilege-escalation-sudo-tee tactic: privilege-escalation techniques: - T1059 - name: Persistence via Scheduled Cron Jobs observables: - /etc/cron.d/ssync - /home/egnyteservice/ssync.sh - /etc/crontab entry for egnyte_host_monitor_client - /etc/rc.d/cron modification on pfSense slug: persistence-via-scheduled-cron tactic: persistence techniques: - T1059 - name: Deployment of BRICKSTORM and AGENTPSD observables: - /usr/sbin/ (BRICKSTORM directory) - /usr/local/bin/egnyte/egnyte_host_monitor_client - /usr/local/libexec/ipsec/blacklist slug: malware-deployment-brickstorm-agentpsd tactic: execution techniques: - T1059 - T1505.003 - name: C2 and Proxying via DoH and Cloudflare observables: - 8.8.8.8:443 - TLS connections to Google Public DNS - Cloudflare IP addresses - M365 access via internal proxy traffic slug: c2-proxying-via-doh-and-cloudflare tactic: command-and-control techniques: - T1071 - T1090.003 - name: Lateral Movement to Synology NAS observables: - Synology NAS web interface admin logins - PLENET malware deployment - SSH enabled via web interface slug: lateral-movement-and-nas-compromise tactic: lateral-movement techniques: - T1078 - T1133 summary: VerdantBamboo compromised an MSP to obtain administrative credentials, which were then used to breach edge appliances including Egnyte Storage Sync, pfSense firewalls, and Synology NAS systems. The actor deployed BRICKSTORM and AGENTPSD malware to establish persistence and create proxy tunnels into internal networks and Microsoft 365 environments, effectively bypassing conditional access policies by appearing as internal traffic. series: index: 2 slug: verdantbamboo-just-another-brickstorm-in-the-firewall title: 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # VerdantBamboo Stolen Credential and Pivot Hunt This hunt identifies VerdantBamboo tradecraft focusing on edge appliances like Egnyte Storage Sync and Synology NAS. The actor uses compromised credentials for the egnyteservice account and other administrative logins, often bypassing MFA by connecting through established VPN tunnels. The hunt first scopes the environment for these appliances using software inventory, then fans out to stack-count authentication source IPs and investigate suspicious web-based management activity. An agent correlates these signals to identify lateral movement or unauthorized appliance configuration. ## scope-appliances Identify hosts running software associated with the targeted appliances to focus subsequent queries. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames belonging to storage or firewall appliances. If empty, the hunt can still run but will lack specific appliance context. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%egnyte%' OR LOWER(package_name) LIKE '%synology%' OR LOWER(package_name) LIKE '%pfsense%' OR LOWER(vendor_name) LIKE '%egnyte%' OR LOWER(vendor_name) LIKE '%synology%') ``` ## corroborate-activity parallel: - → rare-admin-auth-sources - → appliance-management-web-access join: → triage-appliance-access ## rare-admin-auth-sources Stack-count source IPs for administrative logins to find external or rare actors. ```sqlite target=identity role=baseline params=(target_users=target_users, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Administrative logins from a source IP seen on only one or two hosts. This isolates potentially malicious VPN or SSH access from legitimate broad MSP usage. prevalence: by: dst_endpoint_name key: - src_endpoint_ip rare_below: 3 reads: - actor_user_name - dst_endpoint_name - src_endpoint_ip - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-09-20' ~~~ SELECT src_endpoint_ip, actor_user_name, COUNT(DISTINCT dst_endpoint_name) AS host_count, COUNT(*) AS login_total, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE (instr(',' || '{{target_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name HAVING host_count <= 2 ORDER BY host_count ASC ``` ## appliance-management-web-access Detect access to administrative web paths on storage appliances. ```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Direct access to management URLs. Unauthorized source IPs accessing these paths suggests an actor is reconfiguring the device via the web interface. reads: - device_hostname - src_endpoint_ip - time - url_path - user_agent silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_path, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/webman/%' OR LOWER(url_path) LIKE '%/syno/%' OR LOWER(url_path) LIKE '%/egnyte/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-appliance-access ```agent target=hunter cite: required context: - scope-appliances - rare-admin-auth-sources - appliance-management-web-access max_iterations: 4 objective: Determine if any host shows evidence of administrative credential abuse from a rare source IP followed by web-based reconfiguration or SSH access. success_criteria: A verdict of malicious | suspicious | benign per host, citing the specific rows from auth and http activity. tools: - endpoint - identity - web ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host showing both a rare authentication source and web management access" (confidence: high, judge=hunter) then: → contain-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: missing-appliance-telemetry) else: → analyst-review ## contain-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the identified appliance hostname. Rotate passwords for egnyteservice and administrative accounts. Terminate all active VPN and SSH sessions associated with these accounts. ``` → forensic-verification ## forensic-verification ```manual target=analyst Perform forensic analysis on the isolated appliance. Search for the PLENET backdoor or AGENTPSD (Python reverse shell). Check /usr/sbin, /home/egnyteservice, and /etc/crontab for unauthorized modifications. Review sudoers for the tee privilege escalation vulnerability. ``` → analyst-review ## analyst-review ```manual target=analyst Review the agent's triage and forensic findings. Verify if the source IPs for the SSH/VPN logins match known MSP infrastructure. Document any discovered indicators for the broader SOC and close out the hunt. ``` → end