Edge Appliances Face Multi-Nexus Convergence as APTs and Cybercriminals Target Identical Vendors
A collaborative study by Tenable and SentinelOne has revealed that perimeter infrastructure—including firewalls and VPN gateways—is heavily targeted by five distinct threat categories: China, Russia, North Korea, Iran, and financially motivated cybercrime groups. The findings stem from a cross-analysis of Tenable's exposure telemetry across thousands of customer environments and SentinelOne's digital forensics and incident response (DFIR) case files. Although the two data sets shared only 21% of observed Common Vulnerabilities and Exposures (CVEs), they exhibited an 79% overlap across affected vendors. For edge and remote access appliances, this vendor overlap reached 100% across Fortinet, Citrix, Ivanti, Palo Alto Networks, Cisco, Juniper, and VMware. The investigation identified 93 documented exploitation cases across roughly 40 distinct threat groups, highlighting 12 "multi-nexus" vulnerabilities confirmed to be exploited independently by both state-backed and cybercriminal actors. Notably, zero-day flaws in SonicWall SMA1000 and PAN-OS GlobalProtect were leveraged by espionage actors before being repurposed by INC Ransomware operators. Similarly, a Check Point Quantum platform vulnerability was exploited independently by a Chinese group and the Iranian threat actor Fox Kitten. Tenable's telemetry indicated that 53.8% of monitored F5 environments ran at least one active, unpatched vulnerability, while Citrix devices exhibited a median patch delay of 461 days. Additionally, Ivanti appliances demonstrated rapid vulnerability cadences, with actively exploited flaws recurring every 8.5 months on the EPMM line and every 13 months for Connect Secure.
Commentary
The key takeaway here is the disconnect between vulnerability tracking and actual perimeter risk. For years, defender playbooks have focused on prioritizing specific CVEs disclosed during incident fire drills. However, threat actors—whether state-sponsored or pure cybercrime syndicates—are not merely chasing single disclosed bugs; they are targeting whole hardware and firmware ecosystems. The fact that nation-state groups and ransomware affiliates like INC independently hit the exact same vendor perimeter devices (e.g., SonicWall, Palo Alto Networks, Check Point) proves that perimeter software architectures represent a shared soft underbelly. Organizations relying heavily on edge gateways from Ivanti, Fortinet, F5, and Citrix must acknowledge that patch management alone is failing; with median patch delays exceeding 400 days on certain platforms, perimeter appliances cannot be treated as secure bastions. Immediate defensive actions must shift away from perimeter-only trust models toward continuous session re-authentication, aggressive network segmentation behind edge devices, and strict isolation of management interfaces from both the public internet and internal core subnets.
The Quote to Remember
“Des acteurs étatiques et des groupes cybercriminels, agissant sans lien entre eux, trouvent chacun leur propre chemin d'accès chez les mêmes fournisseurs.”
“Le délai médian pour appliquer un correctif sur ses équipements atteint 461 jours, et 71 % des environnements concernés hébergent toujours une vulnérabilité non corrigée un an après sa divulgation.”