Old vulnerabilities on unwatched edge devices are still how nations get in

Edge device security still decides breaches: ten agencies say China-linked actors used eight known CVEs, some more than a decade old. The lesson is hygiene and mailbox identity, not novelty.

Rothian · Cyber practice9 October 20263 min read

What happened

On 8 October 2026, CISA published joint advisory AA26-281A, together with the FBI, the NSA and seven international partners. The authors include the UK's National Cyber Security Centre, the Australian Signals Directorate's Australian Cyber Security Centre, the Canadian Centre for Cyber Security, Japan's National Police Agency and National Cybersecurity Office, New Zealand's National Cyber Security Centre and Spain's Centro Nacional de Inteligencia.

The advisory says that Integrity Technology Group, a China-based cybersecurity company with reported links to the Chinese government, enables China-linked actors to break into networks worldwide and steal sensitive data, including email and credentials. The activity overlaps with groups publicly known as Flax Typhoon, Ethereal Panda and Red Juliett. Victims named include US critical infrastructure in government services, critical manufacturing, healthcare and information technology, as well as US law enforcement, education and religious organisations, and organisations in Southeast Asia, Africa and North America. According to the accompanying CISA announcement, the actors target edge devices that the victim does not closely monitor, to keep long-term, stealthy access.

The technical detail is the useful part. The advisory lists eight vulnerabilities the actors successfully exploited, in products including GNU Bash, ProFTPD, ISC BIND, Apache Struts, Pulse Connect Secure, GitLab, ONLYOFFICE DocumentServer and Strapi. The oldest dates from 2014. Five of the eight are newly added to CISA's Known Exploited Vulnerabilities catalogue.

The actors combine large-scale botnets, VPN infrastructure, living-off-the-land techniques and a repository of exploitation tools. They scan with common tools, spray passwords against Exchange and Microsoft 365 interfaces, dump credentials from domain controllers, persist through SoftEther VPN clients disguised as ordinary Windows processes, and pull email continuously, using stored credentials, through the Exchange Web Services API and a tool that collects Outlook 365 mail. The advisory says the information comes from multiple FBI investigations.

Why it matters

The entry point is old and unglamorous. None of the eight vulnerabilities needed a new exploit. Each is a known flaw in software that should have been patched or retired years ago. The practical risk for most organisations is not a sophisticated zero-day but an unmanaged system they have forgotten they run.

Edge devices fall between teams. Nobody monitors the appliance, the legacy file server or the abandoned test instance as closely as they monitor laptops. The advisory describes exactly this gap. If your asset inventory is built from the endpoints you manage, it will miss the systems an attacker finds first.

Mailboxes are the prize, and identity is the route. Password spraying against Microsoft 365, domain-controller credential dumping and automated mail collection all point the same way: the attackers want credentials and email. Strong authentication on mail and remote access, and alerts on unusual mailbox behaviour, matter as much as patching.

Indicators are a weak defence on their own. The advisory says many of its indicators date to 2016 and should be vetted before blocking. Because the actors use legitimate tools, behaviour-based detection and good logging carry more weight than blocklists.

We would not read the attribution as the main message. Whether or not your organisation is a likely target of a state, the techniques in this advisory work against any organisation with the same gaps.

What we would do

Find every internet-facing system you own. Run external discovery from the attacker's side, then reconcile it with your asset register. Anything found that nobody can name an owner for is a finding in itself.
Check the eight CVEs and retire what you can. Search your estate for the listed products and versions. Patch, or better, decommission end-of-life systems. A system that cannot be patched should not face the internet.
Put multi-factor authentication on mail, VPN and remote access. The advisory names webmail, VPNs and critical-system access specifically. Disable legacy authentication paths that bypass it.
Hunt, then log. Look for unexpected Active Directory replication, unusual outbound upload volumes from workstations, unfamiliar VPN client software and connected cloud applications with access to mail. Confirm you retain the logs needed to answer these questions.
Vet indicators before blocking them. Use the advisory's indicator files for hunting, but check their age and relevance first, as the advisory advises.
Rehearse eviction. Decide in advance who can isolate a host, rotate credentials and rebuild a server, and how you would report an incident to your national authority.

The common thread is dull and effective: know what you expose, patch or remove it, and protect the identities and mailboxes behind it. If you are unsure where your gaps are, take specialist advice before an incident rather than after.

Questions we are asked

We are a UK organisation. Does this advisory apply to us?

The UK's NCSC is one of the ten co-authors, and the techniques described are not specific to one country. The named victims are mostly in the US, Southeast Asia and Africa, but the weaknesses exploited, such as unpatched internet-facing software and weakly protected mailboxes, are common everywhere. Treat it as a checklist for your own estate rather than as a statement about who is targeted.

Why would anyone exploit vulnerabilities from 2014 or 2015?

Because they work. Internet-facing systems that nobody owns, such as old file servers, appliances and test environments, often never receive patches. Automated scanning finds them cheaply. An attacker has no need to spend a new exploit on a target that an old one will open, so the oldest unpatched system in your estate is often the real front door.

Is blocking the indicators in the advisory enough?

No. The advisory itself warns that many indicators date back to 2016 and should be vetted before blocking, and the actors rely on legitimate tools and ordinary logins, which indicators do not catch. Blocking helps, but the durable defences are patching and retiring exposed systems, multi-factor authentication on mail and VPNs, and logging good enough to spot unusual behaviour.