Cybercriminals switch up their top initial access vectors of choice

“Because they operate at this critical boundary, they often hold elevated privileges and have broad visibility into internal systems,” Linares noted, adding that edge devices are often poorly maintained and not integrated into standard patching cycles.

Linares explained: “Many edge devices come with default credentials, exposed management ports, secret superuser accounts, or weakly configured services that still rely on legacy protocols — these are all conditions that invite intrusion.”

Once compromised, edge devices provide attackers with privileged access, persistence, and a clean staging ground for lateral movement. These systems often store administrator credentials, session tokens, VPN keys, or logs that provide a detailed roadmap of the internal infrastructure.