Vulnerability
Exploitation of Citrix NetScaler ADC/Gateway: CVE-2023-3519 RCE, the Citrix Bleed session-token theft (CVE-2023-4966), and Citrix Bleed 2 (CVE-2025-5777).
Vulnerability
Exploitation of the Cisco IOS XE Web UI (CVE-2023-20198 + CVE-2023-20273) to create privileged accounts and deploy Lua webshell implants at scale.
Vulnerability
Exploitation of SonicWall firewalls (CVE-2024-40766) by Akira and Fog ransomware, and the UNC6148 campaign against end-of-life SMA 100 appliances with the OVERSTEP rootkit.
Vulnerability
Successive Ivanti Connect Secure zero-days (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282, CVE-2025-22457) exploited by UNC5221 with the SPAWN and BRICKSTORM implants.
Vulnerability
Exploited FortiOS SSL-VPN flaws (CVE-2024-21762, XORtigate) and the FortiManager FortiJump bug (CVE-2024-47575); Volt Typhoon and the Belsen Group config leak.
Vulnerability
Exploitation of PAN-OS: the CVE-2024-3400 GlobalProtect unauth RCE (Operation MidnightEclipse) and the CVE-2025-0108 management-interface auth bypass.