For two years, the headlines have told a tidy story: China-nexus actors are hammering edge devices from Ivanti, Fortinet, and Palo Alto Networks. A new joint analysis from Tenable and SentinelOne's Incident Readiness & Response team — built on 93 CVE-to-actor attribution pairs — dismantles that narrative. The edge is not a nation-state problem. It is a shared attack surface where state-sponsored espionage groups and financially motivated cybercriminals independently converge on the same vulnerabilities, often against the same vendors, within overlapping windows of exploitation.
That distinction matters enormously for defenders. If your threat model treats edge device exploitation as an APT problem, your patching priority, detection coverage, and IR playbooks are calibrated wrong. Cybercriminal groups operationalize edge CVEs for initial access brokerage, ransomware staging, and botnet recruitment on compressed timelines. State actors pursue persistence and stealth. Both hit the same boxes. Your perimeter appliances are now the single most contested piece of real estate in your environment — and the data shows no single adversary profile owns that fight.
This post breaks down what the convergence means operationally and delivers detection and hardening guidance your SOC can implement this week.
Technical Analysis: Why the Edge Is the Convergence Point
The affected platform class
The research centers on network edge and perimeter infrastructure: VPN concentrators and SSL VPN gateways, next-generation firewalls, secure web gateways, and zero-trust access appliances — with Ivanti, Fortinet, and Palo Alto Networks products named as recurring targets across the 93 attribution pairs. These devices share a set of properties that make them uniquely attractive across adversary categories:
- They are internet-facing by design. No phishing lure or insider required — the attack surface is a routable IP.
- They run privileged network functions. Compromise yields traffic interception, credential capture, and a pivot point into internal segments.
- They are forensic black holes. Most appliances run stripped-down, proprietary operating systems with no EDR support, limited logging, and volatile storage. Traditional endpoint detection simply does not apply.
- Patching is operationally painful. Firmware upgrades on perimeter devices require maintenance windows and downtime coordination, which translates directly into extended exposure windows that both actor classes exploit.
How exploitation typically works
Across the campaigns represented in these attribution pairs, the attack chain follows a consistent pattern defenders can build coverage against:
- Reconnaissance and fingerprinting — mass scanning for exposed management interfaces, specific firmware banners, and known-vulnerable build numbers.
- Initial exploitation — pre-authentication remote code execution or authentication bypass against the web management plane or VPN portal.
- Post-exploitation on the appliance — deployment of webshells or implants into device web directories, modification of startup/config persistence mechanisms, and disabling or tampering with local logging.
- Staging and pivoting — use of built-in binaries and scripting environments living on the appliance, outbound callback infrastructure (often on uncommon ports), and lateral movement into the internal network using harvested VPN or service credentials.
- Divergent endgames — state actors entrench quietly and siphon traffic; criminal actors sell access or detonate ransomware downstream. The first four steps look nearly identical. That is your detection window.
Exploitation status
The Tenable–SentinelOne dataset documents confirmed, independent exploitation of the same edge CVEs by multiple unrelated actors — not theoretical risk. The practical takeaway: when an edge vendor ships a security advisory, assume multiple well-resourced actors are racing to weaponize it, including criminal groups who historically reverse-engineer patches within days. Exposure telemetry matters as much as vulnerability intel — knowing you have an affected device on the wire before the actor converges on it is the entire game.
Detection & Response
Edge appliances can't run your EDR agent, so detection must shift to three planes: (1) telemetry from the device (syslog/CEF into your SIEM), (2) network behavior around the device, and (3) downstream endpoint artifacts that betray a compromised perimeter pivot. The rules below target behaviors common to documented edge-device campaigns: webshell-spawned command execution, management interface exposure, anomalous outbound connections from appliances, and logging tampering.
---
title: Edge Appliance Web Server Spawning Shell or System Utilities
id: 3f9c1a72-8d4b-4e5a-b6c7-2d1e4f5a6b7c
status: experimental
description: Detects web server or VPN portal processes on edge appliances spawning shells or system utilities — a hallmark of webshell deployment following edge CVE exploitation (observed across Ivanti, Fortinet, and Palo Alto campaigns).
references:
- https://www.tenable.com/blog/edge-infrastructure-under-siege
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- 'httpd'
- 'nginx'
- 'sslvpn'
- 'webserv'
- 'lighttpd'
- 'php'
- 'tomcat'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/python'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
- '/base64'
- '/openssl'
- '/nc'
- '/ncat'
condition: selection_parent and selection_child
falsepositives:
- Vendor maintenance scripts and legitimate upgrade processes during change windows
level: high
---
title: Edge Device Configuration Export or Logging Tampering
id: 8b2d5e61-4c7a-4f89-9d1e-3a5b6c7d8e9f
status: experimental
description: Detects command-line patterns associated with configuration exfiltration, credential harvesting, or log clearing on network edge appliances — consistent with post-exploitation tradecraft used by both state and criminal actors on compromised perimeter devices.
references:
- https://www.tenable.com/blog/edge-infrastructure-under-siege
- https://attack.mitre.org/techniques/T1070/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.defense_evasion
- attack.t1070
- attack.collection
logsource:
category: process_creation
product: linux
detection:
selection_config:
CommandLine|contains:
- 'show full-configuration'
- 'execute backup'
- 'diagnose vpn'
- 'cat /data/config'
- 'running-config'
selection_logtamper:
CommandLine|contains:
- 'execute log delete'
- 'rm -rf /var/log'
- '> /var/log'
- 'history -c'
- 'truncate -s 0'
condition: 1 of selection_*
falsepositives:
- Legitimate administrator backup operations via scripted automation — correlate with change tickets
level: high
---
title: Outbound Connection from Edge Appliance to Rare External Destination
id: c4e7a2f1-9b3d-4e58-a6f2-1c8d9e0f5a3b
status: experimental
description: Detects outbound network connections sourced from perimeter appliance VLANs to uncommon external destinations or ports. Compromised edge devices routinely beacon from the appliance itself since no EDR is present to observe it.
references:
- https://www.tenable.com/blog/edge-infrastructure-under-siege
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1071
logsource:
category: firewall
product: zeek
detection:
selection:
src_zone: 'edge_appliances'
dst_port:
- 4444
- 8081
- 8443
- 9001
- 5555
- 1337
filter_vendor_update:
dst_domain|endswith:
- '.fortinet.com'
- '.fortiguard.com'
- '.paloaltonetworks.com'
- '.ivanti.com'
condition: selection and not filter_vendor_update
falsepositives:
- Vendor telemetry and licensing callbacks on non-standard ports — maintain an allowlist of documented vendor endpoints
level: medium
The KQL hunt below assumes your edge devices forward syslog/CEF into Sentinel (CommonSecurityLog / Syslog tables) and that Defender covers your internal endpoints for pivot detection:
// Hunt: edge appliance syslog anomalies + downstream pivots
// Part 1: Management-plane logins from unexpected sources on edge devices
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor in ("Fortinet", "Palo Alto Networks", "Ivanti")
| where DeviceEventClassID has_any ("login", "auth", "admin")
| summarize LoginCount = count(), Sources = make_set(SourceIP, 20)
by DeviceName, DestinationUserName, bin(TimeGenerated, 1h)
| where LoginCount > 10 or array_length(Sources) > 3
| project TimeGenerated, DeviceName, DestinationUserName, LoginCount, Sources;
// Part 2: Rare outbound destinations from edge device subnets (baseline deviation)
let EdgeDevices =
CommonSecurityLog
| where DeviceVendor in ("Fortinet", "Palo Alto Networks", "Ivanti")
| summarize by DeviceIP;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP in (EdgeDevices)
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
| summarize ConnCount = count(), Ports = make_set(DestinationPort) by SourceIP, DestinationIP, DestinationHostName
| order by ConnCount asc;
// Part 3: Internal endpoints receiving inbound from edge appliance IPs (pivot indicator)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP in (EdgeDevices)
| where ActionType == "InboundConnectionAllowed"
| join kind=inner (DeviceProcessEvents | where TimeGenerated > ago(7d))
on DeviceId, $left.LocalPort == $right.LocalPort
| summarize by DeviceName, RemoteIP, FileName, ProcessCommandLine, InitiatingProcessAccountName
For Velociraptor deployment on jump hosts, management servers, and any Linux systems adjacent to the perimeter, this artifact hunts the downstream residue of an edge-device pivot:
-- Edge Pivot Residue Hunt: credentials and lateral movement artifacts on management hosts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(mimikatz|sekurlsa|procdump.*lsass|comsvcs.*MiniDump|nmap -|masscan|proxychains|chisel|ligolo)'
OR (Name =~ '(?i)(ssh|scp|sftp)' AND Username =~ '(?i)(admin|root|svc_)')
// Also sweep for recently dropped scripts/binaries in temp and web-adjacent paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/tmp/**', '/var/tmp/**', '/dev/shm/**', '/opt/**/cgi-bin/**'])
WHERE Mtime > now() - 604800
AND NOT IsDir
ORDER BY Mtime DESC
Hardening and verification script for Linux management hosts and appliance-adjacent infrastructure:
#!/bin/bash
# Edge infrastructure exposure audit — run from a management/jump host
# Purpose: identify exposed management interfaces and verify segmentation
echo "=== [1] Scan perimeter ranges for exposed management interfaces ==="
# Replace CIDR with your public perimeter range
PERIMETER="203.0.113.0/28"
for PORT in 443 4443 8443 10443 22 161; do
echo "-- Port $PORT --"
nmap -Pn -p $PORT --open $PERIMETER -oG - | grep "open"
done
echo "=== [2] Verify management interfaces are NOT internet-routable ==="
# Any management plane answering on a public IP is a finding — escalate immediately
echo "=== [3] Audit local firewall rules restricting edge device outbound ==="
iptables -L OUTPUT -n -v | grep -Ei "fortinet|paloalto|ivanti" || \
echo "WARNING: No vendor-specific egress restrictions found"
echo "=== [4] Confirm syslog forwarding from edge devices is active ==="
for DEV in edge-fw-01 edge-vpn-01; do
timeout 3 bash -c "echo > /dev/tcp/$DEV/514" 2>/dev/null && \
echo "$DEV: syslog reachable" || echo "$DEV: syslog UNREACHABLE — investigate"
done
echo "=== [5] Check for unexpected files in web/temp dirs on adjacent Linux hosts ==="
find /tmp /var/tmp /dev/shm -type f -mtime -7 -executable 2>/dev/null
echo "=== [6] Verify firmware version inventory against vendor advisories ==="
echo "Pull current firmware via device API/SSH and diff against vendor PSIRT feeds:"
echo " Fortinet: https://www.fortiguard.com/psirt"
echo " Palo Alto: https://security.paloaltonetworks.com"
echo " Ivanti: https://www.ivanti.com/blog/topics/security-advisory"
Remediation
Given that no single CVE defines this story, remediation is programmatic — but no less urgent:
-
Inventory your edge, completely. Use exposure telemetry (as Tenable's own data demonstrates) to enumerate every internet-facing appliance, its firmware build, and its exposure status. You cannot defend convergence against an inventory you don't have. Unknown or orphaned edge devices are the highest-probability compromise candidates.
-
Adopt an exploit-convergence patching SLA. The 93-pair dataset proves multiple actor classes weaponize the same edge CVEs independently. Treat every edge vendor advisory as KEV-equivalent by default: assess within 24 hours, patch or mitigate within 72 hours for internet-facing devices. Subscribe to Fortinet PSIRT, Palo Alto Networks security advisories, and the Ivanti security advisory feed directly.
-
Remove management interfaces from the internet — today. No legitimate architecture requires a firewall or VPN management plane reachable from arbitrary external IPs. Restrict to dedicated management networks with jump-host access and MFA. This single step neutralizes a significant fraction of the exploitation observed in these campaigns.
-
Egress-filter the appliances themselves. Edge devices should only talk to documented vendor update/telemetry endpoints. Any other outbound connection from an appliance is a detection-worthy anomaly (see Sigma rule three above).
-
Centralize and protect device logging. Forward syslog from every edge device to your SIEM in real time. Local device logs are routinely wiped post-exploitation; off-box telemetry is often the only forensic record that survives. Alert on logging gaps from edge devices as a standalone signal.
-
Assume breach on unpatched exposure windows. If your telemetry shows a device ran a vulnerable build during a known exploitation window, don't just patch — hunt. Review authentication logs, configuration diffs, and outbound connections retroactively, and rotate any credentials that transited the device (VPN user creds, service accounts, API keys, certificates).
-
Update your threat model language. Brief leadership that edge exploitation is adversary-agnostic. Board-level framing of "the China problem" understates criminal risk and produces misallocated budget. The correct frame: the perimeter is contested by everyone, and dwell-time reduction plus patch velocity are the metrics that matter.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.