LevelBlue: vulnerability exploitation rose to 14% of initial access
The firm's Q1 figure was 20%, while Verizon's 2026 DBIR put exploitation behind 31% of breaches.
1
Stories per day · 30 days
2 RSS
Relatedcredential-theft2critical-infrastructure2d-link2greynoise2pawns.app2proxyjacking2agentic-ai1batch-normalization1byovd1cyberstrikeai1data-theft1fortigate1fortiweb1globalprotect1inc1incident-response1initial-access1japan1
17 stories, newest first · one card per story
Stories tagged #edge-devices
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
1
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
2
BatchNorm buffers can fake deletion in split-learning unlearning
CIFAR-10 forget accuracy fell 61.50 points from BN recalibration with every learnable weight fixed.
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
7
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
CISA, FBI detail SafePay ransomware hitting 600+ victims since 2024
Agencies say SafePay uses stolen or guessed passwords, phishing, and five known edge-device flaws, then encrypts files for crypto payment.
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.
5
skynox7: Proxyjacking Edge Devices Into Residential Proxies
An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.
10
What the BPFDoor backdoor tells us about attacks on the network edge
Rapid7 says BPFDoor stays silent on Linux edge devices until a magic packet arrives.
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.
2
Xiiaozet LK100W
CISA warns of three flaws, including OS command injection, in Xiiaozet LK100W devices before firmware 2.1.240 that allow attackers to take full control of the device.
Disruptive cyber activity highlights risk from internet-exposed systems and edge devices
NCSC links disruptive cyber activity to internet-exposed systems and edge devices, urging OT owners to fix avoidable vulnerabilities and improve resilience.
1
Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter
Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.
1
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
2
New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies
A newly observed Mirai-based Linux botnet dubbed Evooo1Bot compromises edge devices and turns them into persistent proxies for threat actors.
1