Exploit Public-Facing Application

Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.^[12]

APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.^[13][14]

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.^[15][16]

APT39 has used SQL injection for initial compromise.^[17]

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.^[18] APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access.^[19] APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.^[20]

APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.^{[21][22][23] [24]}

ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.^[25]

Axiom has been observed using SQL injection to gain access to systems.^[26][27]

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.^[28]

BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.^{[29][30][31][32]}

BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.^[33]

Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.^[34]

BOLDMOVE is associated with exploitation of CVE-2022-49475 in FortiOS.^[35]

During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.^[36]

During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.^[37]

During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.^[38]

Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j.^{[39][40][41][42]}

COATHANGER is installed following exploitation of a vulnerable FortiGate device. ^[43]

During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.^{[44][45][46][47][48]}

Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.^[49]

Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.^[50]

Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.^[51][52]

FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.^[53][54]

FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.^[39]

FLORAHOX Activity has exploited and infected vulnerable routers to recruit additional network devices into the ORB.^[55]

Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.^{[56][57][58][59][60]}

FrostyGoop Incident was likely enabled by the adversary exploiting an unknown vulnerability in an external-facing router.^[61]

GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.^[62][63]

GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.^[64]

HAFNIUM has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server.^{[65][66][67][68][40][69]}

Havij is used to automate SQL injection.^[70]

For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.^[71]

INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.^[72][73]

Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.^[74]

Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.^[75]

Leviathan has used exploits against publicly-disclosed vulnerabilities for initial access into victim networks.^[76]

Leviathan exploited public-facing web applications and appliances for initial access during Leviathan Australian Intrusions.^[76]

Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).^{[77][78][79][80][81][40]}

Medusa Group has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access.^[82][83] Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.^[84]

menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.^[85]

Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.^[86]

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).^[87]

During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.^[88]

During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.^[89]

During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.^[90][91]

During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.^[92]

Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.^[93][94]

Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.^[95]

Quad7 Activity has enabled the exploitation of vulnerabilities for remote code execution capabilities in SOHO routers including CVE-2023-50224 and CVE-2025-9377 in TP-Link devices.^[96][97]

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.^[98][99]

Salt Typhoon has exploited CVE-2018-0171 in the Smart Install feature of Cisco IOS and Cisco IOS XE software for initial access.^[100]

Sandworm Team exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.^[101][102]

Sea Turtle gained access to victim environments by exploiting multiple known vulnerabilities over several campaigns.^[103][104]

During ShadowRay, threat actors exploited CVE-2023-48022 on publicly exposed Ray servers to steal computing power and to expose sensitive data.^[105]

During SharePoint ToolShell Exploitation, threat actors exploited authentication bypass and remote code execution vulnerabilities (CVE-2025-49706 and CVE-2025-49704) against on-premises SharePoint servers. This activity was characterized by crafted POST requests to the ToolPane endpoint /_layouts/15/ToolPane.aspx.^{[106][107][108][109][110][111]}

Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.^[112]

During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.^[113][15]

SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.^[114]

SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.^[23][55]

sqlmap can be used to automate exploitation of SQL injection vulnerabilities.^[115]

Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler "Citrix Bleed" (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).^[116]

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.^[117]

ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.^[118]

UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.^[119][8]

Versa Director Zero Day Exploitation involved exploitation of a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.^[120]

Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.^{[121] [122]}

Volt Typhoon has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.^[123][124]

Winter Vivern has exploited known and zero-day vulnerabilities in software usch as Roundcube Webmail servers and the "Follina" vulnerability.^[125][126]

ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.^[127]

Application isolation will limit what other processes and system features the exploited target can access.

Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.

Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.

Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.

Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.

Update software regularly by employing patch management for externally exposed applications.

Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.^[10]