Attackers turned exposed firewalls into a route toward credentials and internal administration. A reported China-linked operation scanned 19,000 internet-facing devices, narrowed the set to 240 potential targets, and exploited 25 during October 23-24, reportedly placing root webshells on 24. Activity advanced on two systems in a U.S. government-affiliated environment. From one firewall management server, the attackers reached configurations, credentials, and settings for managed firewalls.
Why It Matters
Root access at the edge can quickly become control over systems that manage many other devices. The attackers also decrypted an LDAP service account password, enumerated domain users and groups, attempted password spraying, and tried to create backdoor accounts. For leaders: firewall management planes should be treated as high-value identity and configuration assets. For defenders: patch the PHP and Linux issues, inspect exposed devices for persistence, and rotate credentials reachable from management systems. The larger lesson is that perimeter appliances can become launch points into the identity layer.
What Defenders Should Do
Isolate and investigate exposed firewalls before rotating every credential accessible through their management infrastructure.