Security and networking devices are “edge devices,” meaning they are connected to the internet. If an attacker is successful in exploiting a vulnerability on these appliances, they can gain initial access without human interaction, which reduces the chances of detection.
As long as the exploit remains undiscovered, the threat actor can reuse it to gain access to additional victims or reestablish access to targeted systems. Additionally, both edge devices and virtualization software are difficult to monitor and may not support endpoint detection and response (EDR) solutions or methods to detect modifications or collect forensic images, which further reduces the likelihood of detection and complicates attribution.
Read more…
Source: Mandiant