Edge exploitation is concentrating on VPNs, old CVEs and fresh bots

At a glance

What this is: GreyNoise's H2 2025 analysis shows edge attacks concentrating on VPNs, old vulnerabilities, residential botnets and AI infrastructure rather than spreading evenly across the internet.

Why it matters: IAM and security teams need to treat internet-facing access paths, device exposure and identity-adjacent infrastructure as a live attack surface, not a perimeter assumption.

By the numbers:

• GreyNoise analyzed 2.97 billion sessions over 162 days in H2 2025.
• Palo Alto GlobalProtect received 16.7 million sessions, more than 3.5x Cisco and Fortinet combined.
• 52% of remote code execution attempts came from IPs with no prior history in GreyNoise data.

Context

GreyNoise's H2 2025 analysis focuses on the security problem of edge exposure: internet-facing systems attract concentrated scanning, exploitation and credential abuse because they offer direct access paths into enterprise networks. The pattern matters to identity and access teams because VPNs, remote access gateways and adjacent access controls sit at the boundary between authentication and network entry.

The report is useful because it separates broad defensive assumptions from observed attacker behaviour. Fresh infrastructure, residential IPs and long-lived vulnerabilities show that perimeter controls and recency-based prioritisation do not fully describe how attackers operate at the edge.

Key questions

Q: How can security teams detect edge device exploitation?

A: Security teams detect edge device exploitation by monitoring internet-facing appliances for unexpected reboots, configuration changes, new admin accounts, and outbound connections that do not match normal management traffic. Correlate device logs with network telemetry and hunt for known indicators tied to vulnerable models. Patch quickly, isolate suspicious devices, and verify configuration integrity after remediation.

Q: Why do fresh attacker IPs make edge defence harder?

A: Fresh IPs break the assumption that threat intelligence will identify bad infrastructure before it is used. When attackers continuously spin up new hosts or abuse residential networks, reputation scores and blocklists decay quickly. Teams need behavioural detection, exposure monitoring and correlation across sessions, not just source-based filtering.

Q: What breaks when patching focuses on individual CVEs instead of attack chains?

A: You can close a headline flaw and still leave the attacker’s next step open. Real intrusions often combine initial access, privilege escalation, and control bypass, so patching must be sequenced around the path an attacker would actually take. Otherwise, remediation reduces risk on paper while the practical exploit chain remains intact.

Q: How should teams judge the risk of residential IP abuse in credential attacks?

A: Treat residential source traffic as a meaningful abuse signal when it appears at scale, especially in spray or login-automation patterns. The question is not whether the IP looks familiar, but whether the session behaviour matches legitimate users and whether access controls can distinguish automated distributed abuse from normal demand.

Technical breakdown

Why internet-facing VPNs attract concentrated exploitation

Internet-facing VPN appliances create a high-value intersection between network reachability and identity trust. Once an attacker compromises a VPN gateway, the appliance can become a direct path into internal resources, often bypassing controls that would otherwise apply to external users. That makes the device itself part of the identity control plane, not just a network service. Concentrated targeting also means defenders cannot rely on generic perimeter hardening alone. They need visibility into appliance exposure, authentication abuse, configuration drift and the blast radius created by remote access trust. See the Remote Access Identity Guide. See the Remote Access Identity Guide.

Practical implication: Treat remote access gateways as privileged entry points and review whether authentication, device posture and offboarding are enforced at every login.

How fresh attacker infrastructure defeats static detection

GreyNoise's finding that 52% of remote code execution attempts came from IPs with no prior history shows how quickly attackers can cycle infrastructure. This is a detection problem as much as a blocking problem. Traditional reputation feeds and historical allow or deny lists age quickly when attackers use short-lived hosts, rented cloud instances or residential proxies to stay ahead of cataloguing. The practical challenge is to pair broad telemetry with behaviour-based detection, because source history alone no longer predicts threat legitimacy. In practice, defenders need to look for exploit technique and request pattern, not just known-bad origin. See the Vulnerability Management Guide.

Practical implication: Shift detection logic from static IP reputation toward exploit behaviour, request anomalies and telemetry that survives infrastructure churn.

Why old vulnerabilities stay exploitable long after patch campaigns move on

The report's pre-2015 CVE traffic shows that age is not a good proxy for safety. Attackers keep using older weaknesses because they remain exposed, poorly inventoried or operationally hard to remove. This is especially relevant to edge appliances and public services, where patch windows, configuration constraints and change risk often slow remediation. A mature exposure programme must therefore rank by exploitability, reachability and asset criticality, not by release year alone. Long-tail exposure is a governance failure when patching focuses on novelty instead of real attack concentration.

Practical implication: Prioritise edge assets by exploitability and exposure, not by CVE age, and keep long-tail weaknesses in active remediation queues.

Threat narrative

Attacker objective: The objective is to gain repeatable entry into exposed enterprise infrastructure and sustain exploitation against edge services that sit close to identity and network trust boundaries.

1. Entry begins with mass scanning of internet-facing VPNs, routers and AI infrastructure to find exposed services that accept remote connections.
2. Credential access and exploitation follow when attackers use stolen logins, sprayed credentials or unpatched edge flaws to gain a trusted foothold.
3. Impact occurs when the access path gives direct network reach or enables repeatable exploitation at scale, including credential abuse and automated reconnaissance.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Edge exploitation is now an identity governance problem as much as a network problem. When a VPN gateway becomes the first trusted hop, authentication and remote access controls define the blast radius of compromise. That is why the concentration of targeting on GlobalProtect matters: it reflects where attackers expect privileged entry, not just where they expect software bugs. Security teams should treat remote access governance as part of identity architecture, not a standalone perimeter control.

Fresh infrastructure has become a standing feature of exploit operations. If more than half of remote code execution attempts come from IPs with no prior history, then historical reputation loses predictive value quickly. The control gap is not only detection latency, but the assumption that known-bad sources will remain known long enough to matter. Practitioners need behaviour-led telemetry and exposure triage that can keep pace with churn, especially at the edge.

Long-tail exposure is the more durable risk signal than recency. The report's old-CVE traffic shows that attackers exploit what remains reachable, not what appears in the latest briefing cycle. That makes patch governance, asset inventory and service retirement a single operational problem. Teams that optimise only for fresh vulnerabilities will keep missing the attack paths that persist for years.

Residential and cloud-sourced abuse is collapsing the usefulness of simple geolocation and reputation controls. A campaign built from 300,000 residential IPs can look distributed, local and legitimate unless the defender has strong behavioural correlation. That changes how access telemetry, fraud logic and abuse detection should be interpreted. The practitioner conclusion is that trust signals must move beyond origin and toward session behaviour, identity context and service sensitivity.

What this signals

Edge governance is becoming the control plane for remote identity risk. As VPNs, firewalls and AI endpoints absorb more scanning and exploitation pressure, security leaders need to assess whether their access boundary is instrumented like a privileged system or treated like ordinary infrastructure. The programme implication is straightforward: edge systems require identity-aware monitoring, tighter exposure control and faster retirement of unnecessary access paths.

Long-tail vulnerability management needs a new prioritisation lens. The article reinforces that old CVEs remain active attack surface when they are still reachable, especially on internet-facing devices. A practical response is to align remediation queues to exposure and exploitability rather than age, and to keep edge appliances visible in the same governance process as core identity and remote access services.

Behavioural detection must replace source-centric trust signals. When attacker infrastructure can churn faster than historical feeds update, defenders have to evaluate sessions by what they do, not where they originate. That shift matters for IAM, SOC and fraud teams alike because it ties identity assurance to live session evidence instead of static reputation.

For practitioners

• Harden internet-facing remote access paths Review VPNs, firewalls and routers as privileged entry points, then verify MFA, posture checks, patch status and exposure on every externally reachable access path.
• Retire reputation-only blocking decisions Use exploit behaviour, request patterns and session anomalies as primary signals, because attacker infrastructure now turns over faster than static blocklists can age.
• Prioritise long-tail CVEs by reachability Rank exposed assets by exploitability and business criticality, then keep old but reachable vulnerabilities in the same remediation queue as current ones.
• Track residential and proxy-based abuse separately Split residential IP activity from corporate traffic in detection and fraud logic so distributed spray campaigns do not blend into normal access patterns.

Key takeaways

• Edge systems are now a concentrated attack surface where VPNs, routers and AI endpoints attract disproportionate scanning and exploitation.
• The report shows that fresh infrastructure and residential IPs can overwhelm reputation-only defences, while old vulnerabilities remain profitable targets.
• Practitioners should tighten remote access governance, prioritise exposed long-tail CVEs and move detection toward behaviour rather than source reputation.

Related NHI Mgmt Group resources: Remote Access Identity Guide · Vulnerability Management Guide · VPN Security Guide · Salt Typhoon telecom intrusions 2025

Key terms

• Edge Exposure: The condition where internet-facing applications, devices, or control planes are reachable from outside the organisation. It matters because attackers can discover and exploit those systems without needing an internal foothold, especially when patching or asset ownership is inconsistent.
• Residential Proxy: A residential proxy routes traffic through an address assigned to a real consumer device or household connection. That makes the traffic look more legitimate than datacentre-based proxies, which is why abuse actors use it to bypass reputation checks and blend into normal user traffic.
• Long-Tail Vulnerability: A vulnerability that remains exploitable long after it stops being new or headline-worthy. The risk is not novelty but reachability, because old flaws often persist in exposed systems, embedded devices and difficult-to-patch services where attackers still find usable entry points.
• Behaviour-driven Detection: Behaviour-driven detection focuses on what an adversary does rather than only on where a signal comes from. It improves correlation and precision because the control is anchored to technique patterns that can appear across multiple tools and log sources.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.