VerdantBamboo 18 months of sustained intrusion that exposes the vulnerability of MSP and applications

A Chinese-linked espionage group, traced as NC5221 or VerdantBamboo, re-exposed a dangerous combination: managed supplier engagement, advanced malware and undefended targets such as storage applications and firewalls. Volexity researchers document how attackers took advantage of the backdoor known as Brickstorm and two previously unseen tools - Plenary and AgentPSD- to maintain persistent access to Microsoft 365 environments and supplier infrastructure for at least 18 months before detection.

The technical relevance is the mix of techniques: Brickstorm acts as an advanced implant with variants initially written in Go and then in Rust, and offers proxying capabilities that allow attackers to "mix" with legitimate traffic and bypass controls as conditional Access policies by using stolen credentials and web tunnels. Plenet (also reported as Grimbolt) is a .NET multiplatform backdoor that uses WebSocket and multiplexation for its C2, while AgentPSD is a simple back door in Python designed as an alternative mechanism of persistence. The use of applications such as Egnyte Storage Sync, Synology NAS, pfSense and old mail servers reflects the predilection of the actor by vectors that usually lack robust EDR.

The above-mentioned intrusion also includes a critical aspect of the supply chain: the attackers committed the client's MSP and, with a reasonable degree of probability, pivoted from there towards the target environment. This underlines that the safety of a customer is closely linked to the hygiene and segmentation of the supplier; the classical remediation in a single perimeter is not sufficient if the supplier continues to connect with broad privileges.

The operational implications are clear and serious: a stay of 18 months means prolonged exfiltration or visibility to sensitive intellectual / political flows; the re-use of credentials and the configuration of VPN / SSL access in firewalls show that attackers not only rely on exploits, but also on legitimate configuration changes that are hardly distinguished without adequate telemetry; and the ability to turn off C2 infrastructure when seen suggests a mature operation that adapts their infrastructure quickly.

For security and IT teams this requires concrete and prioritized actions: first, take the possibility of engagement and run a forensic sweep on administrative access loops, changes in VPN / SSL configuration and unusual movements to legacy and application systems. It's essential. Rotate credentials and keys, force reauthentication of privileged accounts, apply MFA for all management accounts, and segregate MSP accounts with access with minimum privileges and with audited and limited sessions in time.

In parallel, we need to tighten access controls to Microsoft 365: strengthen conditional Access policies with session risk controls, force verifiable post devices and block connections that present proxy patterns or use unusual persistent channels on port 443. Where possible, deploy EDR or, if the device cannot support it (NAS, old applications), incorporate detection on the network to examine WebSocket telemetry and multiplexation in outgoing connections to detect C2 encapsulated.

No less important is the management of the supplier: to audit the MSP accounts, to require access by jump host with full record of sessions, to review the separation of environments and to require security controls equivalent to those of the client. Undertake breach simulation exercises and penetration tests focused on edge applications helps to discover blind points before the exploiters take advantage of them.

For technical equipment that needs specific indicators and artifacts, Volexity published its analysis and a collection of IOCs that can be used as a starting point for searches and blockages: Volexity analysis and the repository with IOCs in GitHub to integrate in detection and lock lists: IOCs VerdantBamboo in GitHub. In addition, reviewing and understanding how Microsoft's Conditional Access policies work will help design rules that hinder legitimate traffic blending and malicious access: documentation of Conditional Access.

In short, what this case shows is that highly targeted adversaries combine custom malware with "living-off-the-land" techniques, point to forgotten infrastructure gears and exploit operational confidence in suppliers. The defense requires not only patches and EDR, but segmentation, network telemetry, MSP governance, regular configuration reviews and a continuous detection mentality; without these layers, organizations will continue to face long and difficult intrusions to eradicate.