Three edge appliances landed on CISA’s Known Exploited Vulnerabilities catalog this week — Progress LoadMaster, SonicWall SMA1000, and Fortinet FortiOS — all confirmed under active attack. The pattern is familiar and damning: these are not zero-days. They are known, patched vulnerabilities in internet-facing infrastructure that organizations have not yet remediated. Meanwhile, Poland disclosed a months-old OT breach that punched through a private cellular APN to shut down a turbine serving 50,000 residents. The theme today is edge exposure — the devices sitting at the boundary of every network, trusted implicitly and patched reluctantly.

In the News

Progress LoadMaster RCE Hits CISA KEV — Active Exploitation Confirmed

CISA added a critical remote code execution vulnerability in Progress LoadMaster to the Known Exploited Vulnerabilities catalog after confirming active attacks in the wild. LoadMaster is deployed as an application delivery controller and load balancer across healthcare, financial services, and government environments — exactly the sectors that can least afford unplanned downtime from a compromise.

The KEV listing triggers a mandatory remediation deadline for federal agencies under BOD 22-01, but the operational reality applies to every organization running LoadMaster. Internet-facing management interfaces are the primary attack surface. Progress has issued patches, and any unpatched instance should be treated as potentially compromised.

This is not a novel attack pattern. Edge appliances with exposed management planes have been the most reliable initial access vector for ransomware operators and state-sponsored groups for three consecutive years. LoadMaster joins FortiGate, Citrix NetScaler, Ivanti Connect Secure, and SonicWall SMA in a growing list of application delivery and VPN appliances that attackers actively scan for and exploit within days of disclosure.

What defenders should do: Patch LoadMaster immediately. If patching requires a maintenance window, restrict management-plane access to trusted IPs via NGFW policy or ACLs. Audit access logs for anomalous administrative sessions. Run exposure scans to identify every LoadMaster instance — including those in lab or development environments that may have been forgotten.

FBI and South Korea Warn of Gunra Ransomware Exploiting Fortinet and Schneider Flaws

A joint advisory from the FBI and South Korea’s National Police Agency details active Gunra ransomware campaigns targeting government agencies, healthcare providers, and financial institutions. The group’s initial access vector is not sophisticated: Gunra exploits known vulnerabilities in Fortinet FortiOS and Schneider Electric industrial control systems. The advisory names specific CVEs and provides indicators of compromise.

The operational significance is twofold. First, the advisory covers both IT and OT attack surfaces — Gunra is not limiting itself to corporate networks. Schneider Electric vulnerabilities in the advisory affect programmable logic controllers and SCADA components deployed in critical infrastructure. Second, the multi-agency nature of the warning signals that Gunra’s victim count is high enough and geographically broad enough to warrant coordinated international response.

For defenders, the takeaway is that this is a patch management failure at scale. Every CVE in the advisory has an available fix. The advisory explicitly states that Gunra’s success depends on organizations running unpatched Fortinet and Schneider equipment — not on zero-day capabilities.

What defenders should do: Audit FortiOS and Schneider Electric deployments against the specific CVEs in the advisory. Enforce IT/OT network segmentation to prevent lateral movement from compromised IT assets into OT environments. Deploy EDR on endpoints within the blast radius of Fortinet-managed network segments. Review the advisory’s IOC list and ingest into SIEM and firewall block lists.

SonicWall SMA1000 SSRF Exploited by Ransomware — CVSS 10.0

CISA confirmed that two server-side request forgery vulnerabilities in SonicWall SMA1000 remote access appliances are being actively exploited by ransomware operators. One of the flaws carries a CVSS score of 10.0 — the maximum possible severity. The SMA1000 series is deployed across thousands of mid-market and enterprise environments for SSL-VPN and remote access.

A CVSS 10.0 SSRF in a remote-access appliance is about as bad as edge vulnerabilities get. The flaw allows an unauthenticated attacker to reach internal services through the appliance, effectively turning the VPN concentrator into a proxy for lateral movement. Ransomware operators have already operationalized this — the CISA KEV listing confirms exploitation, not just theoretical risk.

Organizations running SMA1000 appliances face a binary decision: patch immediately or take the appliance offline. There is no safe middle ground when ransomware operators are actively scanning for the vulnerability. Longer term, this is another data point in the case for replacing traditional VPN appliances with zero-trust network access architectures that do not expose a full network stack to the internet.

What defenders should do: Patch SMA1000 firmware to the version specified in SonicWall’s advisory. If patching is not possible within 24 hours, take the appliance offline and shift remote access to an alternative method. Audit SMA1000 logs for indicators of SSRF exploitation — unusual internal service access patterns originating from the appliance. Evaluate SSE and ZTNA alternatives that eliminate the exposed appliance attack surface entirely.

Poland Uncovers Hidden OT Attack — Turbine Shut Down via Private Cellular APN

Polish authorities disclosed a second critical infrastructure cyberattack at a heat plant serving 50,000 residents. Attackers reached operational technology systems through a private cellular access point name (APN) — the type of connectivity that operators routinely treat as equivalent to an air gap. Once inside the OT environment, the attackers shut down a steam turbine and disrupted water treatment processes. The breach went undetected for months.

A private APN provides a dedicated data path over cellular infrastructure, but it is not air-gapped in any meaningful sense. The cellular carrier’s core network, the APN gateway configuration, and the endpoint devices all present attack surface. In this case, attackers traversed that surface and reached systems that directly controlled physical processes. The months-long dwell time compounds the severity — the plant had no monitoring capable of detecting unauthorized OT commands.

This incident joins a growing pattern of OT breaches that exploit assumed isolation. Private networks — whether cellular APNs, MPLS circuits, or dedicated fiber — reduce exposure compared to the public internet but do not eliminate it. The operational lesson is that any network path to OT must be monitored with the same rigor as an internet-facing connection.

What defenders should do: Audit all network paths into OT environments, including cellular APNs, satellite links, and vendor maintenance connections. Deploy OT-aware anomaly detection on east-west traffic within industrial control system networks. Enforce segmentation policy between IT and OT zones regardless of transport medium. Treat “private network” as a risk reduction, not a risk elimination.

Today’s Deep Dive — Decentralized Ransomware Infrastructure Is Changing the Takedown Game

Two threat reports published this week highlight the same structural shift: ransomware and botnet operators are moving their command-and-control and victim communication infrastructure onto decentralized platforms that resist traditional takedowns.

Microsoft’s analysis of the DeadLock ransomware — a Rust-based encryptor deployed by Lynx and INC affiliates — documents the use of Session messaging (an onion-routed protocol) and blockchain-hosted leak sites for victim negotiations and data publication. Separately, Unit 42’s Kimwolf v7 botnet analysis details how the botnet uses Ethereum Name Service (ENS) records for command-and-control resolution with Tor as a backup routing layer (MITRE ATT&CK: T1102 — Web Service, T1573 — Encrypted Channel).

The practical consequence for defenders is that domain seizures, hosting provider takedowns, and IP blocklists — the tools that law enforcement and security teams have relied on to disrupt criminal infrastructure — are losing effectiveness against these architectures. An ENS record pointing to a C2 address cannot be seized by a court order the way a traditional domain can. A Session-based negotiation channel does not traverse infrastructure that a hosting provider can disable.

Detection must shift from infrastructure indicators to behavioral patterns. DNS queries resolving ENS .eth names, outbound connections to known Tor entry nodes, and encrypted channels that do not match expected application behavior are all high-fidelity detection signals. EDR and network detection tools that rely primarily on domain and IP reputation will miss these operators entirely.

Detection Spotlight

Monitor for Ethereum Name Service resolution attempts — a signal of blockchain-based C2 that standard DNS filtering may miss. The following Splunk SPL query identifies DNS queries for .eth domains, which should be rare to nonexistent in corporate environments:

index=dns sourcetype=stream:dns OR sourcetype=syslog
| where match(query, "\.eth$")
| stats count by src_ip, query, dest_ip
| where count > 1
| sort -count

Any hit warrants immediate investigation. Legitimate .eth resolution is uncommon in enterprise environments and typically indicates either blockchain-based C2 communication or cryptocurrency-related activity that may violate acceptable use policy. False positive rate is low in environments without authorized blockchain operations.

Defender Action Items

  • Patch Progress LoadMaster, SonicWall SMA1000, and FortiOS against the specific CVEs cited in this week’s CISA KEV additions and the FBI/South Korea Gunra advisory — treat all three as patch-now priorities
  • Audit all network paths into OT environments, including private cellular APNs, for unmonitored connectivity that bypasses IT/OT segmentation controls
  • Ingest IOCs from the FBI/South Korean Gunra advisory and Microsoft’s DeadLock analysis into SIEM and firewall block lists
  • Add DNS monitoring for .eth domain resolution and outbound Tor connections as indicators of decentralized C2 infrastructure
  • Review browser extension policies in environments using ChatGPT or AI tools — the AI Chat Helper extension returned to Chrome Web Store after a previous ban and resumed stealing AI conversation data before being removed again

Detection Queries

index=dns sourcetype=stream:dns OR sourcetype=syslog
| where match(query, "\.eth$")
| stats count by src_ip, query, dest_ip
| where count > 1
| sort -count

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.