Group-IB and NyxLab investigate edge-device intrusions: check VPN and remote administration entry points
Group-IB and NyxLab describe intrusion activity targeting public-facing VPNs, firewalls and similar devices, involving vulnerabilities, password guessing and remote administration tools. The more than 70,000 records cited in the report are exposed credential records, not an equivalent number of victim organisations.
Source Facts
In joint research published on 21 October, the two companies say they found attackers broadly searching for public network devices, then trying vulnerabilities or password guessing. After gaining entry, attackers may abuse legitimate remote administration tools to maintain access.
Researchers identified over 70,000 exposed credential records related to network devices, enterprise directories and other systems. The figure describes the volume of research data, not 70,000 victim businesses.
The report observes overlap between some targets and ransomware incidents but explicitly says the operators' direct relationship with specific ransomware groups remains unconfirmed. Businesses should examine their own exposure and credential risks, rather than judge solely by industry or attacker name.
Edge devices and legitimate administration tools both need asset, account and alert management.
Original sources
- Stray Cat, Open Doors: How k0t Wanders Through the Network Edge ↗Published 2026.10.21
Reporting leads · The Hacker News
The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration