Internet-Facing Edge Devices: A Preferred Initial-Access Target

Introduction

Firewalls, VPN gateways, load balancers, and remote-access appliances sit at the edge of every enterprise network, trusted by everything behind them. In 2025, that trust became a significant liability. Google's Threat Intelligence Group (GTIG) reports that attackers exploited 90 zero-day vulnerabilities in the wild this year, and for the first time, close to half of them targeted enterprise technology rather than browsers or mobile devices. Edge devices and security appliances - the very products meant to keep attackers out - have increasingly become a way in. Because these devices often sit between the internet and internal networks, a single compromise can provide attackers with privileged access to downstream systems. This post breaks down why that shift happened, who is behind it, and what it means for how organizations should defend their perimeter.

The 2025 Zero-Day Landscape: Enterprise Edge Under Siege

GTIG's annual report, "Look What You Made Us Patch," tracked 90 zero-days exploited in 2025, up 15% from 78 in 2024, though still below 2023's record of 100. The more telling number is the shift in targets: 43 vulnerabilities (48%) hit enterprise technologies, an all-time high in both raw count and share of total exploitation. Meanwhile, browser-based exploitation fell to historical lows, suggesting attackers are moving toward infrastructure that is harder to monitor and easier to defend poorly. As GTIG analyst Casey Charrier put it, the struggle to protect highly privileged edge devices remains a critical gap, and security flaws in these assets continue to serve as leverage for wide-scale exploitation.

Specific vendors bore the brunt of this activity. Cisco and Fortinet each had four zero-days exploited in 2025, with Ivanti and VMware close behind at three each. Over the past two years, edge-device vulnerabilities from Barracuda, Cisco, Citrix, Fortinet, Ivanti, Juniper, Palo Alto Networks, and SonicWall have all been actively exploited, affecting victims ranging from federal agencies to Fortune 500 companies.

Who Is Exploiting the Edge, and Why

Two very different attacker groups are converging on the same targets, for different reasons. Commercial surveillance vendors led attribution in 2025 with 18 zero-days, while state-sponsored espionage groups from China, Russia, and the UAE accounted for 15. Critically, state-backed actors specifically prioritized edge devices and security appliances such as routers and firewalls as their entry point of choice, while other actors spread their efforts more broadly.

China-nexus groups were especially active, with at least 10 attributed zero-days - double the 2024 figure. One notable case, tracked as UNC3886, exploited an isolation flaw in Juniper MX routers. Another campaign, linked to the BRICKSTORM malware and the group UNC5221, took a longer-term approach: rather than only stealing customer data, the attackers targeted vendors' own source code and development documents - intellectual property that can be mined to discover the next generation of zero-days, threatening not just the vendor but every downstream customer.

Financially motivated actors are following the same playbook. Nine zero-days in 2025 were linked to financially motivated groups, including two ransomware operations, nearly double the five attributed to this category in 2024.

Anatomy of an Edge Device Compromise

Across these incidents, a few recurring weaknesses explain why edge devices keep giving way:

- Exposed management interfaces: Admin panels and API endpoints on VPNs and firewalls are often reachable from the public internet, turning an internal control plane into an external attack surface.

- Default and weak configurations: Default credentials, permissive access rules, and unnecessary enabled services give attackers a head start the moment a vulnerability surfaces.

- Slow patch cycles: Edge appliances are frequently treated as set-and-forget infrastructure, leaving known and unknown flaws unpatched far longer than on standard endpoints.

- Built-in persistence advantages: These devices often sit outside conventional EDR and logging coverage, letting attackers modify firmware and evade detection well after the initial breach.

- Limited segmentation: If a compromised edge device has broad access to internal networks, attackers may be able to use it as a foothold for further discovery and lateral movement.

Use Case: The Ivanti Connect Secure Campaign

The clearest illustration of this pattern is the Ivanti Connect Secure VPN campaign. In January 2025, Ivanti disclosed CVE-2025-0282, an unauthenticated stack-based buffer overflow, which Mandiant traced back to active exploitation beginning mid-December 2024.

Attackers fingerprinted appliance versions using crafted HTTP requests, then deployed a dropper (PHASEJAM) to plant web shells inside ICS components, a credential-stealing script (DRYHOOK), and a tunneling tool (SPAWNMOLE) for command-and-control. The persistence mechanisms were the most alarming part. A related China-nexus actor, tracked as UNC5325, was found capable of maintaining access even after factory resets, system upgrades, and patches, using custom malware and living-off-the-land techniques.

Attackers also used anti-forensic methods, including clearing logs and faking successful system upgrades to hide their presence. A similar pattern played out in May 2025, when Fortinet disclosed CVE-2025-32756, a critical stack-based overflow affecting several of its products, exploited to scan and pivot within victim networks.

Conclusion and Recommendations

The 2025 data makes the trend hard to ignore: attackers increasingly target firewalls and other edge devices as an alternative path past hardened endpoint environments. Edge devices offer privileged network access, weak monitoring, and long patch cycles - an ideal combination for both espionage and financially motivated actors. Looking ahead, GTIG expects AI to accelerate this further, helping attackers automate reconnaissance, vulnerability discovery, and exploit development at scale.

For defenders, a few priorities stand out:

- Treat edge devices as Tier-0 assets, with patch SLAs matching those of domain controllers.

- Prioritize internet-facing vulnerabilities using active exploitation intelligence, such as CISA's Known Exploited Vulnerabilities (KEV) Catalog, rather than relying solely on CVSS severity.

- Assume a factory reset or patch may not fully evict an established attacker - verify with forensic review where risk is high.

- Keep management interfaces off the public internet and apply the same logging and anomaly detection used for core infrastructure.

- Factor vendor security posture into your own threat model, since a vendor breach can seed the next zero-day against you.

The perimeter was never meant to be a weak point - but in 2025, it became one of the most contested pieces of enterprise real estate. Is your organization treating its edge devices with the same urgency as its most sensitive servers, or are they still the forgotten corner of the patch cycle?

Connect with QuassrCyberTech Experts

Ready to strengthen your organization's security posture?

At QuassrCyberTech, our specialized cybersecurity solutions help organizations stay ahead of evolving risks. From Vulnerability Assessment and Penetration Testing (VAPT) to Security Operations Center (SOC) implementation, Red Team exercises, and Governance, Risk, and Compliance (GRC) frameworks, we provide the expertise and tools needed to secure your digital assets and infrastructure.