VerdantBamboo

☆ pin

Also known as Clay Typhoon, UNC5221, Warp Panda

Reports

First seen

Jun 4, 2026

Last seen

Sep 3, 2026

Motivation

Espionage

Targeting

Sectors

Other ×1

Victim regions

United States ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×3T1021.002 Remote Services: SMB/Windows Admin Shares ×2T1105 Ingress Tool Transfer ×2T1195 Supply Chain Compromise ×2T1021.004 Remote Services: SSH ×2T1078 Valid Accounts ×2T1219 Remote Access Software ×2T1059.001 PowerShell ×2T1047 Windows Management Instrumentation ×1T1068 Exploitation for Privilege Escalation ×1T1027 Obfuscated Files or Information ×1T1505.003 Web Shell ×1

Indicators

cve ×6hash_sha256 ×5hash_md5 ×4hash_sha1 ×4filename ×3ip_v4 ×1domain ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26855 (exploited)CVE-2023-27532 (exploited)CVE-2024-4345 (exploited)CVE-2025-68947 (exploited)CVE-2026-20131 (exploited)CVE-2026-22769 (exploited)

Recent reports

High

H1 2026 Malware and Vulnerability Trends Report

Recorded Future InsiktSep 3, 2026 Critical

VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances

The Hacker NewsJun 8, 2026 Critical

VerdantBamboo: Chinese APT Deploys BRICKSTORM Backdoor Across Victim and MSP Infrastructure

VolexityJun 4, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.