Edge Device Forensics: When the Perimeter Becomes a Black Box
14.07.2026 edge-devicesfirmware-forensicsvpn-gatewaysnation-state-actors
Since 2024, firewalls, VPN gateways, load balancers, and routers have moved to the center of a new wave of attacks. Cisco ASA/FTD, Ivanti Connect Secure and Policy Secure, Fortinet FortiClient EMS — barely a quarter goes by without a fresh zero-day against exactly the devices meant to protect the network. For incident responders this creates a double bind: the attacks are high-value and targeted, yet forensic evidence collection on the affected appliances is often technically close to impossible.
Why the Perimeter Becomes a Black Box
Attacker economics are clearly favorable. This explains the pattern of rapid burning of Ivanti, Palo Alto, and Fortinet zero-days throughout 2024 and early 2026 — these exploits are cheap enough to use widely and then discard, rather than carefully preserving them for high-value, single-use operations. For defenders, the calculus looks very different: organizations face high costs when patching edge devices, VPN downtime affects remote workers, common security solutions are not present on edge devices, and even collecting forensic evidence from edge devices is not always straightforward — resulting in a remediation window of at least 30 days that attackers exploit through patch difference analysis. There’s also a structural technical problem: many edge devices operate on in-memory file systems, and a reboot can erase all evidence of compromise.
Cisco’s ArcaneDoor case illustrates just how far this goes. The ArcaneDoor threat actor developed a previously unknown persistence mechanism that survives upgrades to the fixed releases published in September 2025, residing in the FXOS base operating system of Cisco Secure Firewall ASA/FTD software. Forensic work further revealed that on some compromised devices, the actor modified ROMMON to allow persistence across reboots and software upgrades — observed only on platforms lacking Secure Boot and Trust Anchor technology. Cracking the case required intense engineering effort: instrumented images with enhanced detection capabilities, packet capture analysis, and in-depth firmware analysis of infected devices ultimately enabled identification of the underlying memory corruption bug.
When Vendor Tools Become Part of the Problem
The Ivanti Connect Secure incidents are especially alarming. CISA incident response analysis confirmed that both internal and external versions of the Integrity Checker Tool (ICT) were unreliable, since web shells were found on systems showing no file mismatches according to the ICTs — forensic analysis further showed attackers cleaned up their tracks by overwriting files, time-stomping files, and re-mounting the runtime partition to fake a “clean state.” Even worse: independent CISA lab research validated that the ICT is likely insufficient to detect compromise, and that an actor may maintain root-level persistence despite factory resets and appliance upgrades. A standard incident-response reset can therefore destroy exactly the evidence you were trying to preserve — without actually evicting the attacker.
The Ivanti CSA case shows attackers abusing legitimate device functionality directly: the resource /sbin/tripwire, a PHP wrapper for the tripwire binary used to create security reports, contained an update function that passed commands to the binary without sanitization — and because the wrapper ran with sudo privileges, injected commands executed with elevated rights. The pattern continued into 2026: in the Ivanti EPMM case, fallout from earlier zero-days exploited since late January spread to nearly 100 victims, including the Dutch Data Protection Authority and the Council for the Judiciary.
Regulators Are Reacting — Slowly
Policymakers have taken notice. CISA, the FBI, and the UK’s NCSC jointly urged defensive action against nation-state actors exploiting end-of-support edge devices — including load balancers, firewalls, routers, and VPN gateways — to gain network access and compromise sensitive data, with CISA’s Binding Operational Directive 26-02 mandating action for US federal agencies. In parallel, NCSC, ASD, CISA, Canada’s Cyber Centre, and the FBI issued the first concrete forensic-readiness expectations for vendors: devices become targets when they lack secure-by-design/default principles, regular firmware updates, or robust authentication and provide limited logging, making it difficult to detect suspicious activity — compounded by insecure configuration or inadequate network segmentation.
For IR teams, the takeaway is clear: forensic readiness for edge devices cannot be an afterthought bolted onto an emergency runbook — it has to be part of the architecture. Anyone patching a firewall or VPN gateway without first capturing a forensically sound image risks turning the reboot itself into the crime scene cleaner.
← Back to overview