Zero-Day Attacks on Network Edge Devices: Why NDR Matters by Lucie Cardiet

This report describes a surge in zero-day exploitation of network edge devices (firewalls, VPNs, ADCs) highlighted by a Five Eyes advisory and real-world compromises of Citrix NetScaler, Fortinet, Cisco, Palo Alto, SonicWall and others; attackers — including suspected nation-state actors — have used these flaws to gain persistent access, deploy webshells, harvest credentials, disable logging, and move laterally. It details common post-compromise activities (reconnaissance, credential harvesting, lateral movement, data exfiltration, persistence), emphasizes the limitations of traditional security when edge devices are compromised, and promotes Network Detection and Response (NDR) capabilities (specifically Vectra AI) to detect anomalous device behavior and enable rapid response and remediation.