Cybercriminals increasingly exploit admin software for network infrastructure

A new report from Eclypsium's InfraTrust Pulse highlights a surge in attacks targeting management platforms for enterprise network devices, with several critical flaws exploited before patches were available. Between late August and mid-September, the report tracked 158 advisories covering 1,699 vulnerabilities, including 42 critical ones and 71 remotely exploitable without authentication. Notably, the most dangerous exploited flaws were in administrative software, prompting a warning to treat these systems as high-value targets for patching and monitoring.

The report's findings underscore a shift in attacker strategy, with management platforms becoming preferred entry points because compromising them grants broad control over entire device fleets. The Cisco FMC attacks involved multiple threat clusters, including state-sponsored groups and ransomware operators, who chained two separate vulnerabilities together. Attackers used built-in tools for reconnaissance, deployed tunneling utilities, and harvested credentials before deploying Qilin ransomware. A recovered Linux implant, identified as a Cyclops Blink variant linked to the Sandworm group, further illustrates the sophistication of these campaigns. Cisco's separate disclosure of six additional FMC flaws and three maximum-severity ISE vulnerabilities, one already exploited, reinforces the pattern of management software as a primary attack surface.