The Persistent Perimeter Threat: Strategic Insights from a Multi-Year APT Campaign Targeting Edge Devices | Grey Noise Blog
Summary: A Sophos report describes an APT campaign that began in 2018 targeting Cyberoam, an India-based Sophos subsidiary, then shifted from mass exploitation aimed at building operational relay boxes to focused attacks on a small set of high-value targets including government agencies, critical infrastructure, and embassies. The actors used custom rootkits, firmware-level persistence, ICMP tunneling, and proxy chains, and over 35% of the CVEs in Sophos' Database of Network Device CVEs predate 2020, with 95% of them in CISA's KEV catalog.
What's compelling: The entry point was unpatched internet-facing VPNs, routers, and edge devices that teams delay patching because taking them offline disrupts operations - and the same devices now carry firmware-level rootkits that are hard to detect even on PCs with dedicated vendor teams.
Read the original at GreyNoise Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026