The Pivot Point: Exposed Edge Appliances

Today’s most critical attack vector begins not with a phishing email, but with an exposed edge appliance. A detailed analysis reveals a multi-stage intrusion where attackers first breached an exposed F5 BIG-IP appliance, then pivoted to an internal Confluence server for credential theft and identity compromise. This pattern underscores a dangerous reality: internet-facing management interfaces on devices like F5 BIG-IP are prime initial access points. Once inside, attackers rapidly move to exploit internal collaboration tools, turning a single perimeter weakness into a full-scale identity crisis. Organizations must immediately address unpatched vulnerabilities in these systems, specifically CVE-2023-46747 (authentication bypass) and CVE-2023-46748 (remote code execution) in F5 BIG-IP, which serve as the gateway for these sophisticated campaigns.

The Internal Springboard: Confluence Credential Theft

After establishing a foothold via the edge appliance, the threat actor pivoted to an internal Atlassian Confluence server. This phase highlights the critical risk posed by unpatched internal enterprise applications. Confluence instances, often used for documentation and project management, frequently contain credentials, network diagrams, and other sensitive data that fuel lateral movement. The attack leveraged known vulnerabilities, including CVE-2023-22515 (privilege escalation) and CVE-2023-22518 (remote code execution), to compromise the server and harvest identities. This step transforms a perimeter breach into a pervasive internal threat, enabling attackers to attempt Kerberos relay attacks and move toward domain compromise.

Identity Under Attack: Kerberos Relay and Lateral Movement

The final stage of this intrusion demonstrates the attacker’s objective: domain dominance. With credentials stolen from Confluence, the threat actor attempted Kerberos relay attacks to move laterally and escalate privileges within the Active Directory environment. This technique exploits weaknesses in the Kerberos authentication protocol, allowing attackers to impersonate legitimate users and access critical resources. Mitigating this requires disabling legacy RC4 encryption and enabling Kerberos armoring (FAST). Furthermore, setting the msDS-SupportedEncryptionTypes attribute to require strong AES encryption is essential to block these relay attempts and protect the identity layer, which is the ultimate target in modern enterprise intrusions.

Law Enforcement Strikes Back: Disrupting Criminal Infrastructure

In parallel to these technical threats, significant law enforcement actions are disrupting the infrastructure that supports such attacks. Authorities in Europe and North America dismantled ‘First VPN Service,’ a criminal VPN used by at least 25 ransomware groups to obscure their attacks. Separately, Dutch authorities (FIOD) seized 800 servers from a hosting firm that enabled cyberattacks and disinformation campaigns. These takedowns, along with the arrest of the alleged ‘Kimwolf’ IoT botnet operator, demonstrate a growing focus on attacking the infrastructure that enables ransomware, DDoS, and credential theft. While positive, these actions require security teams to rapidly integrate newly released indicators of compromise (IPs, domains, certificates) into their blocking controls.

The Zero-Trust Imperative and Geopolitical Phishing

The Q1 2026 Threat Landscape Report reinforces that attackers are moving faster and exploiting weaknesses before most organizations can respond. This environment makes a Zero-Trust approach to identity non-negotiable. Microsoft’s recognition as a leader in Workforce Identity Security Platforms highlights available tools; organizations should rigorously review Azure AD Conditional Access policies and enforce Privileged Identity Management (PIM). Simultaneously, geopolitical threats remain acute. The Belarus-aligned Ghostwriter (UNC1151) group is actively targeting Ukrainian government entities with phishing lures related to the ‘Prometheus’ learning platform, a reminder that email security and user awareness must adapt to region-specific social engineering.

Immediate action is required on three fronts. First, patch all F5 BIG-IP appliances against CVE-2023-46747 and CVE-2023-46748, and update Confluence servers to address CVE-2023-22515 and CVE-2023-22518. Second, harden your Kerberos implementation by disabling RC4 and enforcing AES encryption. Third, integrate indicators from the ‘First VPN Service’ and Dutch hosting firm takedowns into your threat intelligence feeds and perimeter blocks as soon as they are released by law enforcement.