Mandiant: spies are increasingly attacking ‘edge’ tools such as firewalls and VPNs – Computer – News

Chinese and Russian cybercriminals attempting to spy are increasingly targeting software edgedevices, such as firewalls and VPNs. This is what security company Mandiant states in its annual report.

According to Mandiant, spying cybercriminals from China and Russia used the same method for years. An employee received malicious phishing emails containing malware, which an attacker can use to gain entry into a system. Monitor companies endpointdevices, however, as part of the security strategy, making that method more difficult.

Various attackers have therefore specialized in attacks on devices that are not monitored in this way, Mandiant said in its report. They are shifting their focus to devices with edge software, such as firewalls, gateways and VPNs. They often do not support security and monitoring software. What is also important for cyber criminals is that no user interaction is required for an attack, which further reduces the chance of detection. Attackers can then gain further access to the company’s environment from the device and typically remain in an environment for extended periods of time, Mandiant says. After an attack, forensic analysis is also difficult, because the platform on which such a device is built is often made by suppliers and is also closed.

Mandiant is not alone in warning of increasing attacks on devices with edge tools. The Dutch National Cyber ​​Security Center warned in February against the misuse of publicly accessible ‘edge devices’. The organization recommends various security measures, such as regularly carrying out a risk analysis on edge devices. It is also recommended that you restrict Internet access from such devices and install the latest security updates as soon as possible.