Teetering on the Edge: VPNs, Firewalls' Nonexistent Telemetry Lures APTs

Mandiant's M-Trends analysis reports a shift by China-linked espionage actors toward compromising edge/network appliances (firewalls, VPNs, email gateways) using exploits and native device functionality to evade detection; a bespoke Fortinet-targeting backdoor (BoldMove) and growing exploit-driven initial access and data leak sites were notable trends, and responders face forensic challenges due to limited telemetry and vendor control over device images.