The Hidden Peril: Edge Devices as the Weak Link in Critical Infrastructure Security

The Illusion of Network Segmentation in OT Security

In the realm of Operational Technology (OT) and critical infrastructure cybersecurity, many practitioners hold a fundamental belief: network segmentation is an effective safeguard against cyber threats. By isolating sensitive OT environments from IT networks and the internet, they assume they have created a secure fortress. However, this assumption neglects a crucial vulnerability—Edge devices, including routers, small firewalls, and industrial gateways, which serve as the connective tissue between these networks. These devices are frequently overlooked in security strategies, despite their critical role as perimeter defense points.

Edge Devices: The Perfect Target for APT Groups

Advanced Persistent Threat (APT) groups, particularly state-sponsored actors, have recognized Edge devices as lucrative entry points into sensitive networks. These devices often run outdated firmware, lack robust security controls, and, due to their function, maintain high privileges within the network.

Recent reports, highlight how attackers exploit known and zero-day vulnerabilities in Edge devices to establish initial access. Once inside, they leverage techniques such as Living-off-the-Land (LotL) attacks to maintain persistence and achieve deep control over internal networks.

Check Point Cybersecurity report for 2025 highlights the rise of complex botnets using IoT and edge devices as ORB (Operational Relay Boxes).

ORB Platform. Source: The State of Cyber Security 2025, Check Point

One of the most sophisticated is the Raptor Train botnet, orchestrated by the Chinese APT group Flax Typhoon, which assembled over 200,000 compromised devices, including small office/home office (SOHO) routers, NAS systems, and IP cameras. Organized into multi-tiered layers, the botnet’s structure supports a command-and-control (C2) system through the “Sparrow” platform, enabling remote operations, DDoS attacks, and espionage. The attackers leverage both zero-day and known vulnerabilities, creating a scalable, persistent attack infrastructure with global reach. Through these devices, Flax Typhoon maintains operational control, posing significant risks for both public and private

sector entities.

Volt Typhoon’s Exploitation of Edge Devices

Flax Typhoon is not the only Chinese-aligned actor operating through ORBs. Another state sponsored actor linked to China is Volt Typhoon, known for targeting critical US infrastructure. This state-sponsored campaign, attributed to China, targeted Edge devices from vendors such as Zyxel, DrayTek, and D-Link. These devices, deployed at the perimeter of critical infrastructure networks, were compromised using known zero-day vulnerabilities and weak credentials.

Once attackers gained initial foothold, they operated undetected for months—sometimes over 300 days—without deploying malware. Instead, they utilized legitimate administrative tools and built-in OS functionalities, effectively blending in with normal network activity. This approach allowed them to conduct reconnaissance, escalate privileges, and maintain control while evading traditional security measures.

The Consequences: Persistent Access and Lateral Movement

When an Edge device is compromised, the impact extends far beyond the initial breach. These devices often have privileged access to internal networks, allowing attackers to:

• Establish long-term persistence within critical infrastructure systems.

• Bypass network segmentation and access isolated OT environments.

• Leverage compromised devices for further exploitation, including data exfiltration and sabotage.

• Use the Edge devices as staging points for launching attacks deeper into the organization.

Addressing the Security Gap: Proactive Defense Strategies

Given the significant risk posed by vulnerable Edge devices, organizations must adopt a proactive approach to security. This includes:

1. Regular Patching and Firmware Updates: Many Edge devices run outdated firmware due to operational constraints. Organizations must implement structured patch management processes to mitigate known vulnerabilities.

2. Zero Trust Architecture: Assume that Edge devices can be compromised and implement least-privilege access controls to limit their exposure to sensitive networks.

3. Continuous Monitoring and Threat Intelligence: Deploy solutions that detect anomalous behaviors and unauthorized access attempts on Edge devices.

4. Device Hardening: Disable unused services, enforce strong authentication mechanisms, and implement security baselines for Edge devices.

5. Network Segmentation with Micro-Segmentation: While traditional segmentation is not enough, micro-segmentation can limit an attacker’s ability to move laterally within the network.

6. Regular Security Audits and Red Teaming: Periodic assessments can uncover hidden vulnerabilities and validate the resilience of Edge device security controls.

Conclusion

The reliance on network segmentation as a primary security control is an outdated mindset in the face of evolving cyber threats. Edge devices, often neglected in security strategies, are prime targets for cybercriminals and state-sponsored APTs. The Volt Typhoon attack is a stark reminder of how these perimeter devices serve as entry points into critical infrastructure networks. Organizations must shift their focus towards securing Edge devices, enforcing Zero Trust principles, and adopting proactive defense strategies to prevent catastrophic breaches.

Ignoring this risk is no longer an option—securing Edge devices is essential for protecting the backbone of critical infrastructure.