Named Threats Show a Common Access-Path Pattern

Industry reports often present critical infrastructure threat campaigns as tales of sophisticated, custom-engineered malware designed to disable controllers or trip physical safety systems. While specialized tooling exists, recent threat intelligence reveals a much simpler and more pervasive pattern: adversaries increasingly persist inside environments by abusing the legitimate access pathways operators depend on. Rather than developing complex local exploits, threat actors compromise exposed remote access infrastructure, guess default credentials on unmanaged gateways, and weaponize edge-device vulnerabilities to establish a foothold.

Authoritative joint advisories from the Cybersecurity and Infrastructure Security Agency (CISA), the NSA, and the FBI clearly define this tactical shift. Recent guidance, including joint advisories detailing the “Living Off the Land” techniques of state-sponsored groups like Volt Typhoon.

”

“The login may be valid but the interaction must be monitored and controlled anyway.”

This highlights how attackers evade detection by using built-in network administration tools rather than deploying custom malware. By exploiting unmanaged vendor VPNs, compromised contractor credentials, or unpatched routers, adversaries leverage broad network trust to move laterally and blend their malicious activity with normal system administration.

The risk is compounded by aging infrastructure at the network perimeter. Recognizing this severe vulnerability, CISA issued Binding Operational Directive 26-02 in early 2026, mandating the immediate inventory, remediation, and replacement of end-of-support edge devices, including firewalls, routers, and VPN gateways. Because legacy edge devices sit at the network boundary and are often internet-facing, exploiting a single known vulnerability on an unsupported gateway grants threat actors direct access to the operational technology interior.

Industry reports often present critical infrastructure threat campaigns as tales of sophisticated, custom-engineered malware designed to disable controllers or trip physical safety systems. While specialized tooling exists, recent threat intelligence reveals a much simpler and more pervasive pattern: adversaries increasingly persist inside environments by abusing the legitimate access pathways operators depend on. Rather than developing complex local exploits, threat actors compromise exposed remote access infrastructure, guess default credentials on unmanaged gateways, and weaponize edge-device vulnerabilities to establish a foothold.

Authoritative joint advisories from the Cybersecurity and Infrastructure Security Agency (CISA), the NSA, and the FBI clearly define this tactical shift. Recent guidance including joint advisories detailing the “Living Off the Land” techniques of state-sponsored groups like Volt Typhoon. This highlights how attackers evade detection by using built-in network administration tools rather than deploying custom malware. By exploiting unmanaged vendor VPNs, compromised contractor credentials, or unpatched routers, adversaries leverage broad network trust to move laterally and blend their malicious activity with normal system administration.

The risk is compounded by aging infrastructure at the network perimeter. Recognizing this severe vulnerability, CISA issued Binding Operational Directive 26-02 in early 2026, mandating the immediate inventory, remediation, and replacement of end-of-support edge devices, including firewalls, routers, and VPN gateways. Because legacy edge devices sit at the network boundary and are often internet-facing, exploiting a single known vulnerability on an unsupported gateway grants threat actors direct access to the operational technology interior.