SecuriTricks - edge devices

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

A threat actor nicknamed ViciousTrap has compromised over 5,500 edge devices, transforming them into honeypots. The actor targets more than 50 brands of SOHO routers, SSL VPNs, DVRs, and BMC controllers, possibly to collect exploited vulnerabilities. The infection chain involves exploiting CVE-2023…

gobrat

edge devices

Published: May 23, 2025

Linked vulnerabilities : CVE-2023-20118, CVE-2021-32030

Downloadable IOCs: 15

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Black Basta, a ransomware-as-a-service group, has been using an automated brute forcing framework called BRUTED to target edge network devices since 2023. The framework performs internet scanning and credential stuffing against firewalls and VPN solutions in corporate networks. Black Basta prioriti…

Published: April 16, 2025

Downloadable IOCs: 18

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Black Basta, a ransomware-as-a-service group, has been using an automated brute forcing framework called BRUTED to target edge network devices since 2023. The framework performs internet scanning and credential stuffing against firewalls and VPN solutions in corporate networks. Black Basta prioriti…

Published: April 16, 2025

Downloadable IOCs: 18

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

A critical security vulnerability, CVE-2025-22457, affecting Ivanti Connect Secure VPN appliances has been actively exploited since mid-March 2025. The vulnerability allows remote code execution through a buffer overflow. Two new malware families, TRAILBLAZE and BRUSHFIRE, have been deployed along …

espionage

zero-day

vpn

remote code execution

ivanti connect secure

spawnwave

Published: April 4, 2025

Downloadable IOCs: 0

PolarEdge: Unveiling an uncovered ORB network

An analysis of the PolarEdge backdoor and its associated botnet reveals a sophisticated cyber threat targeting various edge devices. The botnet exploits vulnerabilities in Cisco, Asus, QNAP, and Synology devices, using a TLS backdoor to establish control. Active since at least late 2023, PolarEdge …

botnet

vulnerability exploitation

asus

infrastructure analysis

Published: February 25, 2025

Linked vulnerabilities : CVE-2023-20118

Downloadable IOCs: 31

Bulbature, beneath the waves of GobRAT

This report examines an infrastructure used to control compromised edge devices transformed into Operational Relay Boxes for launching cyber attacks. The infrastructure, consisting of 63 identified servers, uses GobRAT and Bulbature malware to compromise devices and create a botnet. Features includ…

Published: October 4, 2024

Linked vulnerabilities : CVE-2019-13956, CVE-2019-9082, CVE-2017-5638

Downloadable IOCs: 120

Tag: edge devices

Attack reports

ViciousTrap - Infiltrate, Control, Lure: Turning edge devices into honeypots en masse.

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

PolarEdge: Unveiling an uncovered ORB network

Bulbature, beneath the waves of GobRAT