#Edge Security

Edge Appliances Face Multi-Nexus Convergence as APTs and Cybercriminals Target Identical Vendors

A collaborative study by Tenable and SentinelOne has revealed that perimeter infrastructure—including firewalls and VPN gateways—is heavily targeted by five distinct threat categories: China, Russia, North Korea, Iran, and financially motivated cybercrime groups. The findings stem from a cross-analysis of Tenable's exposure telemetry across thousands of customer environments and SentinelOne's digital forensics and incident response (DFIR) case files. Although the two data sets shared only 21% of observed Common Vulnerabilities and Exposures (CVEs), they exhibited an 79% overlap across affected vendors. For edge and remote access appliances, this vendor overlap reached 100% across Fortinet, Citrix, Ivanti, Palo Alto Networks, Cisco, Juniper, and VMware. The investigation identified 93 documented exploitation cases across roughly 40 distinct threat groups, highlighting 12 "multi-nexus" vulnerabilities confirmed to be exploited independently by both state-backed and cybercriminal actors. Notably, zero-day flaws in SonicWall SMA1000 and PAN-OS GlobalProtect were leveraged by espionage actors before being repurposed by INC Ransomware operators. Similarly, a Check Point Quantum platform vulnerability was exploited independently by a Chinese group and the Iranian threat actor Fox Kitten. Tenable's telemetry indicated that 53.8% of monitored F5 environments ran at least one active, unpatched vulnerability, while Citrix devices exhibited a median patch delay of 461 days. Additionally, Ivanti appliances demonstrated rapid vulnerability cadences, with actively exploited flaws recurring every 8.5 months on the EPMM line and every 13 months for Connect Secure.