BRICKSTORM, PLENET, and AGENTPSD Linux appliance deployment
Malware Activity
Summary
Hide ▲
Show ▼
The deployment of BRICKSTORM, PLENET (aka GRIMBOLT), and AGENTPSD on Linux appliances expanded operator access with backdoor, proxying, remote command execution, and fallback reverse-shell capabilities. The malware set was observed during September 2025 after compromise of an Egnyte Storage Sync system and later use of a Synology NAS appliance. The activity is attributed to VerdantBamboo and matters because it combines stealthy appliance abuse with multiple implants and persistence options.
Related Happenings
Major U.S. services company hit by ransomware attack linked to DragonForce
Incident
H score38
First: 16.06.2026 13:18
Last: 16.06.2026 13:18
Sources 1
About this happening:
A DragonForce ransomware incident hit a major U.S. services firm in December 2025, with attackers maintaining access for one to two months and hiding command-and...
Major U.S. services company hit by ransomware attack linked to DragonForce
IncidentAbout this happening: A DragonForce ransomware incident hit a major U.S. services firm in December 2025, with attackers maintaining access for one to two months and hiding command-and...
UNC5221 Brickstorm, Plenet, and AgentPSD access-maintenance malware activity
Malware Activity
H score16
First: 05.06.2026 21:09
Last: 05.06.2026 21:09
Sources 1
About this happening:
The Brickstorm malware set enabled UNC5221 / VerdantBamboo to keep long-term access inside victim infrastructure, including Microsoft 365, raising the risk of stealthy...
UNC5221 Brickstorm, Plenet, and AgentPSD access-maintenance malware activity
Malware ActivityAbout this happening: The Brickstorm malware set enabled UNC5221 / VerdantBamboo to keep long-term access inside victim infrastructure, including Microsoft 365, raising the risk of stealthy...
EtherRAT Node.js backdoor with Ethereum smart-contract C2
Malware Activity
H score20
First: 26.03.2026 17:00
Last: 26.03.2026 17:00
Sources 1
About this happening:
The EtherRAT malware activity centers on a Node.js-based backdoor that uses Ethereum smart contracts to hide and rotate C2 infrastructure. In a React2Shell attack,...
EtherRAT Node.js backdoor with Ethereum smart-contract C2
Malware ActivityAbout this happening: The EtherRAT malware activity centers on a Node.js-based backdoor that uses Ethereum smart contracts to hide and rotate C2 infrastructure. In a React2Shell attack,...
UNC6201 Dell RecoverPoint for Virtual Machines zero-day campaign
Campaign
H score44
First: 17.02.2026 22:15
Last: 17.02.2026 22:15
Sources 1
About this happening:
The UNC6201 campaign has been exploiting a Dell zero-day since mid-2024, creating a sustained risk of unauthorized access and stealthy movement across victims' virtual...
UNC6201 Dell RecoverPoint for Virtual Machines zero-day campaign
CampaignAbout this happening: The UNC6201 campaign has been exploiting a Dell zero-day since mid-2024, creating a sustained risk of unauthorized access and stealthy movement across victims' virtual...
Latest development: 19.02.2026 17:30
CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure affected Dell RecoverPoint systems by Saturday, February 21, after Mandiant and Google Threat Intelligence Group (GTIG) said UNC6201 had exploited the flaw since at least mid-2024.
Pwn2Own Ireland 2025 zero-day demonstrations security flaw
Vulnerability
H score41
First: 21.10.2025 20:06
Last: 21.10.2025 20:06
Sources 1
About this happening:
At Pwn2Own Ireland 2025 in Cork, Ireland, researchers demonstrated 34 unique zero-days on day one, including Team DDOS chaining eight flaws to compromise a Q...
Pwn2Own Ireland 2025 zero-day demonstrations security flaw
VulnerabilityAbout this happening: At Pwn2Own Ireland 2025 in Cork, Ireland, researchers demonstrated 34 unique zero-days on day one, including Team DDOS chaining eight flaws to compromise a Q...
Latest development: 07.11.2025 20:24
QNAP fixed seven zero-day vulnerabilities in QTS and QuTS hero (CVE-2025-62847, CVE-2025-62848, CVE-2025-62849), Hyper Data Protector (CVE-2025-59389), Malware Remover (CVE-2025-11837), and HBS 3 Hybrid Backup Sync (CVE-2025-62840, CVE-2025-62842) after researchers from Summoning Team, DEVCORE, Team DDOS, and a CyCraft technology intern exploited them during Pwn2Own Ireland 2025 against QNAP NAS devices; QNAP recommends updating to the latest versions and changing all passwords.
Timeline
-
08.06.2026 13:27 2 articles · 1mo ago
Initial report: BRICKSTORM, PLENET, and AGENTPSD Linux appliance deployment
Initial DisclosureAn initial compromise of an Egnyte Storage Sync system enabled BRICKSTORM deployment after exploitation of a local privilege escalation flaw. That foothold later let the operators move through the victim's web SSL VPN and into Microsoft 365.
Show sources
- VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances — thehackernews.com — 08.06.2026 13:27
- VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances — thehackernews.com — 08.06.2026 13:27