# VerdantBamboo: Just Another BRICKSTORM in the Firewall

APT compromised Egnyte Storage Sync via default egnyteservice SSH account, abused sudo tee for root, deployed BRICKSTORM/AGENTPSD backdoors and proxied into M365.

- Payout: Real-world hack
- Severity: high
- Program: Egnyte Storage Sync
- Analysis by: Steven Adair
- Disclosed: 2026-06-04
- Write-up quality: 7/10
- Original: https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/
- Library page: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-06-04-verdantbamboo-just-another-brickstorm-in-the-firewall
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:linux technique:chained technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Linux VM appliance (Egnyte Storage Sync) and pfSense firewall
**Root cause:** The egnyteservice sudoers entry grants /usr/bin/tee as root, letting an unprivileged account write arbitrary files anywhere; combined with a default SSH account whose password was reused/leaked from the MSP.
**Steps:**
1. SSH to Storage Sync as `egnyteservice` using valid credentials obtained from the MSP.
2. Abuse sudoers `egnyteservice ALL = PASSWD: EGNYTEAPPS` where EGNYTEAPPS includes `/usr/bin/tee` to write files as root.
3. Write backdoor to `/usr/sbin/` (e.g. `luserput`) via `sudo tee`.
4. Create `/etc/cron.d/ssync` executing `/home/egnyteservice/ssync.sh` to launch the backdoor, then delete the cron file after execution.
5. Add fallback `/etc/crontab` entry: `20 14 15 * * root /usr/local/bin/egnyte/egnyte_host_monitor_client >> /dev/null 2>&1` (AGENTPSD reverse shell).
**How found:** IR triggered by suspicious outbound traffic from an Egnyte Storage Sync VM to a Cloudflare-fronted domain and TLS to 8.8.8.8 (DoH). Snapshots confirmed DoH C2; sudoers review revealed the tee misconfiguration; pivoted to MSP after suspect traffic from their network.
**Exploitation:** Attacker used stolen egnyteservice SSH credentials via the victim's SSL VPN, escalated to root via sudo tee, deployed BRICKSTORM (Golang RAT with command/socks/web tasks) and AGENTPSD fallback, then used the implant's SOCKS proxy to reach M365 blending with legitimate traffic and bypassing Conditional Access. After eviction, re-entered via exposed firewall admin interface with stolen non-MFA admin creds, enabled SSL VPN, and deployed PLENET to a Synology NAS.
**Escalation:** Chained MSP compromise -> credential theft -> appliance root -> SOCKS proxy into M365 -> re-entry via internet-exposed firewall admin panel -> custom VPN -> PLENET on NAS.
**Insight:** Appliance sudoers entries that include general-purpose utilities like `tee` are effectively root; also check for default service accounts (egnyteservice) whose passwords may be reused by MSPs, and hunt C2 via DoH to public resolvers to evade DNS logging.

## Proof of concept (copied exactly from the original report)

**Censys query fingerprinting BRICKSTORM C2 servers**

```
host.service_count<= 4 AND host.services: (banner_hash_sha256:"e28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0" AND port=443) AND host.services.cert.parsed.issuer.organization = "CloudFlare, Inc." AND host.services: (port=22 AND software.vendor:openbsd)
```

**AGENTPSD C2 command POST request**

```
s=web&t=aft&atyp=csi&ei=-qv0YeW-J8TEkPIP8Nmb6A8&rt=wsrt.38,aft.4354,afti.4354,prt.710,sct.403&imn=18&ima=8&imad=8&aftp=907&bb=1&bl=b2ug
```

**Sudo config enabling root file write via tee**

```
Cmnd_Alias EGNYTEAPPS = /usr/local/bin/egnyte/rsync_data_migration.sh, /usr/bin/tee, /usr/bin/config_network, /usr/local/bin/egnyte/config_network, /sbin/reboot, /sbin/poweroff , /usr/bin/systemctl restart networking

egnyteservice ALL = PASSWD: EGNYTEAPPS
```