PLAYBOOKSNETHOSTATTRIBDETECT
← all playbooks
INCIDENT TRIAGE · TIER 2
Edge Device Compromised
VPN concentrator, firewall, or web appliance exploited. 56% of tracked vulnerabilities exploitable without authentication (IBM X-Force 2026). The appliance is the foothold, not the target. The question is: what did they pivot to from the perimeter?
reactive · perimeter breach · pivot-focused · the appliance is already gone
Do not assume patching fixes a compromise. Patching closes the vulnerability. It does not remove web shells, backdoor accounts, modified configs, or stolen credentials that were harvested before the patch. If the device was vulnerable during the exploitation window, treat it as compromised even if it's now patched. Verify integrity independently.
The perimeter device problem

Edge devices (VPN, firewall, load balancer, mail gateway, web application firewall) sit at the network boundary, are internet-facing by design, and run proprietary firmware that most EDR agents cannot cover. They authenticate users, terminate VPN tunnels, and often have implicit trust to the internal network. A compromised edge device gives an attacker authenticated access to the internal network through the front door, often with visibility into every user's credentials as they transit the device.

Frequently targeted platforms (2023-2026)
Hunt checklist: edge device compromised
  1. 1. Verify device firmware and configuration integrity Compare running firmware hash against vendor-published known-good. Export the running configuration and diff against the last known-good backup. Check for: new admin accounts, modified ACLs, new VPN tunnel definitions, altered logging configurations (attackers disable logging first), and unauthorized SSL certificates. Vendor integrity verification tools · Configuration management diff
  2. 2. Check for web shells on the appliance Many edge device exploits (FortiGate, Ivanti, Citrix) result in web shell deployment on the appliance itself. Check web server directories on the device for: files not present in the vendor firmware image, recently modified files, and files with eval/exec/system patterns. Some appliances require vendor support or forensic firmware extraction to inspect. HOST: Persistence · Vendor forensic tools
  3. 3. Extract and analyze all credentials the device handled The compromised device saw every credential that transited it: VPN authentication (usernames + passwords if not using certificate auth), LDAP bind credentials (often the device binds to AD for authentication), RADIUS/TACACS+ shared secrets, and SSL/TLS private keys. Assume all of these are compromised. Reset LDAP bind accounts, rotate RADIUS secrets, and reissue certificates. HOST: Credential Access · Compromised Credentials playbook
  4. 4. Check for credential harvesting during the exploitation window Attackers on a VPN concentrator can capture every user's credentials as they authenticate. Pull authentication logs from the period the device was compromised and treat every account that authenticated during that window as potentially compromised. For high-value accounts (admins, executives), force password resets and session revocations.
  5. 5. Hunt for pivot from the appliance into the internal network The edge device is the foothold. Where did they go? Check internal network logs for: connections originating from the appliance's internal IP to hosts it doesn't normally talk to, new VPN sessions or tunnels established from the device, and lateral movement artifacts (SMB, RDP, SSH) sourced from the appliance's management interface or internal IP. NET: Lateral Movement · Zeek conn.log · Firewall internal interface logs
  6. 6. Check for persistent backdoor access Beyond web shells: check for new local accounts on the device, SSH keys added to the device, modified startup scripts, scheduled tasks or cron jobs on the appliance OS, and reverse tunnels or port forwarding rules (netsh portproxy on Windows-based appliances, iptables rules on Linux-based ones). Volt Typhoon uses netsh portproxy specifically for this. Volt Typhoon playbook · HOST: Persistence
  7. 7. Review all VPN user sessions during the compromise window If the attacker had access to the VPN concentrator, they may have created VPN sessions for their own access that blend with legitimate traffic. Check for: VPN sessions from unusual source IPs (residential, VPS, foreign), sessions outside normal hours, sessions with unusual duration or data volume, and sessions from user accounts that were also used legitimately (attacker piggybacks on a real account). VPN session logs · NET: C2
  8. 8. Check whether logging was disabled or tampered with Attackers who compromise edge devices frequently disable or redirect logging as a first action. Check: are logs being forwarded to your SIEM, is the logging configuration unchanged from baseline, are there gaps in the log timeline (missing hours or days), and has the syslog destination been modified? A gap in logs from a device that normally logs continuously is an indicator. HOST: T1070.001 Clear Logs · Syslog server receipt validation
  9. 9. Determine whether to patch, reimage, or replace Patching alone is insufficient if the device is already compromised. For most compromised appliances: factory reset and rebuild from known-good config is the minimum. For Barracuda ESG (CVE-2023-2868), the vendor recommended full device replacement because persistence survived factory reset. Check vendor advisories for remediation guidance specific to the CVE.
  10. 10. Assess exposure window and notify downstream How long was the device vulnerable? Cross-reference the CVE disclosure date, when your device was patched, and when exploitation began (check vendor threat intelligence for exploitation timelines). Every user who authenticated through the device during the exposure window needs credential resets. If the device handled partner/vendor VPN connections, notify those parties.
Edge devices are the new initial access vector. CrowdStrike's 2026 GTR confirms it: 40% of vulnerabilities exploited by China-nexus actors targeted internet-facing edge devices, and 67% of all China-exploited vulns delivered immediate system access. Edge device exploitation is now the dominant nation-state initial access method, not a secondary option. Volt Typhoon, APT28, APT41, Salt Typhoon, and ransomware affiliates all exploit edge devices because they provide authenticated internal access, often with admin-level trust, and run on platforms that most detection stacks can't monitor. 42% of vulnerabilities were exploited before public disclosure (zero-day first, patch second). If your security strategy starts at the endpoint, you've already lost the perimeter.
OT edge devices: cellular gateways and industrial routers (Dragos 2026). Sierra Wireless Airlink RV50/RV55 cellular gateways were compromised by VOLTZITE (Volt Typhoon) in 2025 as pivot points into OT networks in electric and oil and gas. KAMACITE (Sandworm) scanned the same device family during their US ICS reconnaissance campaign. These devices bypass network perimeter controls via cellular, often sit at unmonitored OT edges, and connect to legacy equipment without security features. IT security teams may not know they exist. Median time from ICS vulnerability disclosure to public exploit: 24 days (Dragos 2026). 73% of all Dragos IR cases involved active exploitation or valid credential reuse of VPN/jumphosts. SYLVANITE (Volt Typhoon initial access team) rapidly weaponizes edge CVEs and hands off compromised environments within days.
Actors who exploit edge devices

Volt Typhoon (FortiGate, Ivanti, Zoho), APT28 (Ubiquiti edge routers for botnet relay), APT41 (Citrix, F5, Confluence), Sandworm (WatchGuard, ASUS via Cyclops Blink), Salt Typhoon (Cisco IOS routers in carrier infrastructure). Every major nation-state actor has edge device exploitation in their toolkit.

Related playbooks

Compromised Credentials (every credential that transited the device is potentially stolen)
C2 Beacon Found (the pivot from edge device to internal implant)
Volt Typhoon (edge device exploitation is their primary initial access)
Air-Gapped OT (edge devices bridging IT/OT are a critical exposure point)