Chinese APT VerdantBamboo Targets Appliances with BRICKSTORM Malware

Gbhackers •Mayura Kathir • June 5, 2026

BRICKSTORM is a modular remote access trojan (RAT) originally seen in Golang and later in Rust. It uses a wssoft library with pluggable “tasks” for shell commands, a Socks5 proxy, and a simple web server for file listing. An incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese APT VerdantBamboo Exploits Brickstorm Malware for Long-term Network Access The Chinese espionage group UNC5221, also known as VerdantBamboo, has been using the Brickstorm backdoor and new malware variants Plenet and AgentPSD to maintain access to compromised Microsoft 365 environments. Investigations revealed that the group had infiltrated victim networks at least 18 months prior to detection, compromising managed services providers (MSPs) to facilitate their attacks. Brickstorm is described as an advanced malware implant, initially developed in Golang and later in Rust. The group has targeted various sectors, including legal services and technology companies, exploiting zero-day vulnerabilities in edge devices since at least 2023. The attackers employed sophisticated techniques to blend in with legitimate traffic, evading security measures. Following the initial breach, they re-entered the network and deployed additional malware, indicating a persistent threat. The ongoing investigation highlights the need for heightened vigilance against such advanced persistent threats. 5 sources 76

Extracted Entities

Chinese APT VerdantBamboo Targets Appliances with BRICKSTORM Malware

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)