Edge Devices in the Crosshairs

A sprawling credential-harvesting operation has been quietly compromising internet-facing network edge appliances — the Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPN gateways that guard the perimeter of countless enterprises. According to research disclosed this week and reported by The Hacker News, the campaign has yielded more than 70,000 sets of credentials and left investigators with evidence that the operators gained access to numerous organizations around the world.

The findings underscore a persistent truth in enterprise security: the devices organizations deploy to keep attackers out are themselves among the most attractive and frequently probed targets on the internet.

What the Investigation Found

Researchers analyzing artifacts from the campaign concluded that the operators behind it did not simply collect credentials and move on. Telemetry and forensic traces suggest the group obtained access to multiple victim environments and, in some cases, attempted to deepen its foothold — a progression that turns a credential leak into a potential intrusion pipeline.

The credential haul is the headline figure, but the more consequential detail is the evidence of post-compromise activity. Access to a perimeter firewall or VPN concentrator is rarely the end goal in itself. It is a doorway into internal networks, and from there into identity systems, administrative consoles, and the data that ultimately matters to an attacker.

Why Edge Devices Keep Falling

Network edge appliances occupy a uniquely exposed position. They must be reachable from the public internet to do their jobs, which means their management interfaces, authentication endpoints, and web components are continuously scanned and probed by automated tooling. A single unpatched vulnerability, a weak or reused administrative password, or a misconfigured management portal can be enough to open the door.

Several structural factors compound the risk:

  • Slow patch cycles. Edge appliances often sit outside standard endpoint patching workflows, and organizations are frequently reluctant to take perimeter infrastructure offline for maintenance windows.
  • Credential reuse. Administrative accounts for these devices are sometimes shared across teams or reused from other systems, so a single leak can cascade.
  • Exposed management interfaces. Management planes reachable from the internet dramatically expand the attack surface.
  • Limited visibility. Many security teams have far less telemetry from their firewalls and VPN concentrators than from endpoints and servers, making anomalous activity harder to spot.

The Credential Problem

A 70,000-credential haul is significant not because of its raw size but because of what credential lists enable. Attackers routinely use harvested username and password pairs for password spraying against VPN portals, identity providers, and remote access services. Because VPN authentication is often the front door to a corporate network, a successful spray can bypass much of the layered defense an organization has built internally.

Credentials also feed the broader cybercrime economy. Even where a particular credential set does not grant immediate access, it can be bundled, sold, or reused against other services where users have recycled passwords.

Defensive Priorities

For organizations running FortiGate, GlobalProtect, or comparable edge infrastructure, the disclosure is a prompt to audit rather than panic. Practical steps include:

  1. Inventory every internet-facing appliance and confirm which management interfaces are actually exposed. Where possible, restrict administrative access to internal networks or a dedicated management plane.
  2. Enforce phishing-resistant multi-factor authentication on all VPN and administrative access. MFA does not eliminate the risk from stolen credentials, but it substantially changes the economics for attackers.
  3. Rotate credentials proactively on any device that may have been exposed, and eliminate shared administrative accounts in favor of individual, auditable identities.
  4. Patch aggressively. Treat edge appliance updates as emergency maintenance rather than routine housekeeping.
  5. Hunt for signs of follow-on activity — unusual authentication patterns, new local accounts, configuration changes, or unexpected outbound connections from the appliance itself.

The Bigger Picture

The campaign fits a well-established pattern: attackers go after the perimeter because it is where trust boundaries are thinnest and where a single mistake grants disproportionate access. The 70,000-credential figure is a reminder that credential theft at scale is not a theoretical risk but an ongoing, industrialized activity.

Organizations should assume their edge devices are being probed continuously and design their defenses accordingly — with hardened management access, strong authentication, rapid patching, and the monitoring needed to detect when something goes wrong.

Source: The Hacker News — Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials