pfsense

A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as well as two other malware families codenamed PLENET (aka GRIMBOLT) and AGENTPSD to target Linux systems. The activity has been attributed by Volexity to a threat cluster it tracks as VerdantBamboo, which it said overlaps with hacking groups known as Clay Typhoon (Microsoft), UNC5221 (Google), and Warp Panda (CrowdStrike). The cybersecurity company said it discovered the intrusion during an incident response engagement in September 2025, when it emerged that the adversary had compromised an unnamed victim's Egnyte Storage Sync system by exploiting a local privilege escalation flaw to deploy BRICKSTORM. The issue was addressed in Storage Sync version 13.13, released in March 2026. "The appliance had periodically been accessed by VerdantBamboo via IP addresses assigned through the victim organization's web SSL VPN," researchers Damien Cash, Paul Rascagneres, Steven Adair, and Tom Lancaster said in a technical report published last week. "The threat actor used the malware's proxying capabilities deployed on the Storage Sync system, along with compromised credentials, to access the victim's Microsoft 365 (M365) environment." It's assessed that these steps were undertaken to blend in with legitimate network traffic and evade Conditional Access policies, with the initial compromise occurring at least 18 months before. Following the initial remediation, VerdantBamboo is said to have staged a return, breaching the same organization by using stolen administrative credentials to connect to the firewall, and then abusing that access to configure web SSL VPN access to the device, connect to other systems, and deploy additional malware to a Synology Network Attached Storage (NAS) appliance. Further investigation has since uncovered that the threat actor had in fact compromised the victim organization's Managed Services Provider (MSP), specifically infecting its MSP's pfSense firewall with a BSD variant of BRICKSTORM around the same time the victim's Storage Sync system was also breached. It's believed that the victim was compromised through the threat actor's breach of the MSP. The two malware families deployed to the NAS appliance over SSH are as follows - PLENET (aka GRIMBOLT), a cross-platform backdoor developed in .NET Core and a new version of BRICKSTORM compiled using native ahead-of-time (AOT) compilation. It supports interactive shell, remote command execution, file manipulation, and command-and-control (C2) server switching. AGENTPSD, a Python-based reverse shell that likely functions as a fallback in case the primary implant ceases to function It's worth noting that the use of PLENET in the wild was reported by Google earlier this February in connection with attacks mounted by a suspected China-nexus threat cluster dubbed UNC6201 that exploited a vulnerability in Dell RecoverPoint for Virtual Machines (CVE-2026-22769, CVSS score: 10.0) as a zero-day since mid-2024. "VerdantBamboo is a highly sophisticated threat actor that seeks to leverage a combination of living-off-the-land techniques and malware deployment on systems that traditionally do not or cannot run EDR software," Volexity said. "This threat actor appears to have good knowledge of proprietary appliances, allowing them to deploy malware with customized persistence mechanisms. They also appear to have operational security discipline aimed at leveraging a limited number of domains and IP addresses per victim and setting up customized implant naming and persistence on a per-device basis."

pfSense: Open-source firewall and routing platform Firewalls, VPN access, and traffic rules need steady attention, often with limited budgets and staff. In that context, the open source pfSense Community Edition (CE) continues to show up in production environments, supported by a long-standing user community. pfSense CE is the free, open-source version of the pfSense firewall and routing platform. The software runs on standard x86 hardware, virtual machines, and some embedded systems, which keeps deployment flexible for small teams and labs. What pfSense CE provides At its core, it functions as a stateful firewall and network router. Administrators manage it through a web-based interface that covers firewall rules, network address translation, and routing policies. The interface exposes configuration options in a way that aligns with common firewall workflows used in enterprise and small business environments. The platform includes support for IPv4 and IPv6, VLAN tagging, and multi-WAN configurations. These features allow teams to segment networks, manage redundancy, and route traffic across multiple connections. Configuration changes apply through the interface and are reflected in the underlying packet filter engine. VPN and remote access capabilities Remote access remains a routine requirement for many organizations. pfSense CE includes built-in support for IPsec, OpenVPN, and WireGuard. Administrators can configure site-to-site tunnels or remote user access using certificates, pre-shared keys, and user authentication. The platform supports common VPN scenarios such as branch connectivity and remote employee access. Logging and status pages display tunnel state, connection activity, and traffic flow to support routine troubleshooting. Package system and extensibility One of the defining aspects of the solution is its package system. Users can install additional services directly from the interface. Available packages include intrusion detection and prevention tools, DNS filtering, traffic monitoring, and high availability helpers. Packages run alongside the core firewall functions and integrate into the same management interface. Each package includes its own configuration pages and logs. Updates are delivered through the same system used for base software updates. Monitoring and visibility The solution includes built-in monitoring tools that track system health and network activity. Dashboards show interface throughput, CPU usage, memory consumption, and uptime. Logs capture firewall events, VPN activity, and system messages. Traffic graphs and status views support routine operational checks. These tools are commonly used by administrators to confirm rule behavior and identify unusual patterns during incident response or performance troubleshooting. Where teams tend to deploy it pfSense CE appears in a wide range of environments. Small organizations often deploy it as a perimeter firewall. Larger teams use it in labs, branch offices, or segmented network zones. The software also appears in cloud environments and home labs used for testing and training. Because it runs on general-purpose hardware, teams often reuse existing systems or virtual infrastructure. This approach aligns with environments that need predictable network control without licensing costs tied to throughput or user counts. pfSense CE is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack OpenGuardrails: A new open-source model aims to make AI safer for real-world use Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!