Loading threat actor…
VerdantBamboo is a China-nexus cyber espionage threat actor associated with long-duration intrusions that prioritize edge appliances and proprietary systems that typically lack endpoint detection and robust logging. The cluster overlaps with activity tracked by other vendors as UNC5221, Warp Panda, and Clay Typhoon. Operations attributed to this actor have demonstrated patience, stealth, and strong tradecraft, including maintaining covert access in victim environments for at least 18 months. VerdantBamboo has targeted enterprise environments through internet-facing and internally trusted infrastructure such as storage synchronization appliances, firewalls, network-attached storage devices, and managed service provider infrastructure. Observed operations included compromise of Egnyte Storage Sync systems, pfSense firewalls, and Synology NAS appliances, as well as abuse of compromised edge devices as covert proxies to access cloud services including Microsoft 365 while blending into legitimate VPN and SSL traffic. The actor has used valid accounts for initial access, including stolen local and administrative credentials, and has escalated privileges by abusing insecure sudo configurations on Linux-based appliances. It combines living-off-the-land techniques with custom malware deployment on Linux and BSD platforms. Malware associated with VerdantBamboo includes BRICKSTORM, a modular remote access trojan including a FreeBSD variant; PLENET, also referred to as GRIMBOLT, a cross-platform .NET Core backdoor compiled with Native AOT; and AGENTPSD, a Python-based fallback reverse shell used to preserve access if primary tooling is removed. Observed capabilities include interactive shell access, remote command execution, file manipulation, command-and-control switching, proxying, and resilient persistence. Persistence mechanisms attributed to VerdantBamboo include modification of startup configurations, scheduled task and cron-based execution, and re-entry through compromised firewall administration and VPN functionality after remediation attempts. The actor has also moved laterally from compromised edge devices into internal systems and leveraged compromised managed services provider infrastructure to facilitate downstream victim access. The overall pattern is consistent with a state-linked espionage actor focused on stealthy, durable access to enterprise networks and cloud-connected environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber espionage campaign targeting edge appliances such as file storage sync systems and pfSense firewalls to gain long-term covert access, pivot into cloud environments, compromise managed service providers, and evade detection on systems that typically lack EDR.
China-nexus cyber espionage activity targeting Linux and appliance-like systems, including Egnyte Storage Sync, pfSense firewalls, Synology NAS, and Microsoft 365 environments. The group used compromised MSP infrastructure, stealthy access via SSL VPN, stolen administrative credentials, and malware tailored for systems that often lack EDR coverage.
Long-term espionage-style intrusions into corporate networks by compromising edge appliances and MSP infrastructure, maintaining persistence for at least 18 months, re-entering environments after eviction, and using custom malware to control firewalls, storage systems, NAS devices, and network appliances.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.