Exploitation of Consumer Devices in Hybrid Work Environments
Summary
Hide ▲
Show ▼
Consumer devices, such as D-Link cameras and video recorders, are increasingly being exploited to compromise enterprise systems. The hybrid work model has expanded the attack surface, as home networks—often built on outdated, insecure devices—serve as an extension of the corporate environment. These devices, which lack proper patching and support, are becoming fertile ground for threat actors aiming to infiltrate enterprise systems from the outside in. The risks stem from the lax security culture around consumer devices, which often remain unpatched and unsupported. Compromised home devices can intercept traffic, change DNS settings, or serve as footholds to access other systems, creating attack vectors that can be exploited to move laterally into business-critical resources. This issue is exacerbated by the fact that enterprise security teams have no control over the personal networks of remote workers, making it difficult to enforce security measures and monitor potential threats.
Timeline
-
26.08.2025 17:00 1 articles · 1mo ago
D-Link Consumer Devices Added to KEV Catalog
D-Link cameras and video recorders have been added to the Known Exploited Vulnerabilities Catalog (KEV), highlighting the risks posed by consumer devices in hybrid work environments. These devices, often unpatched and unsupported, create vulnerabilities that can be exploited to compromise enterprise systems. The shared network environment in homes, where personal and corporate devices coexist, further amplifies this risk.
Show sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
Information Snippets
-
D-Link cameras and video recorders have been added to the Known Exploited Vulnerabilities Catalog (KEV).
First reported: 26.08.2025 17:001 source, 1 articleShow sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
-
Consumer devices often lack proper patching and support, making them vulnerable to exploitation.
First reported: 26.08.2025 17:001 source, 1 articleShow sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
-
Home networks, which serve as extensions of corporate environments, are increasingly targeted by threat actors.
First reported: 26.08.2025 17:001 source, 1 articleShow sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
-
Compromised home devices can intercept traffic, change DNS settings, or serve as footholds to access other systems.
First reported: 26.08.2025 17:001 source, 1 articleShow sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
-
Enterprise security teams have limited control over the personal networks of remote workers.
First reported: 26.08.2025 17:001 source, 1 articleShow sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
-
Insecure consumer devices contribute to the botnet ecosystem, which can be used to launch attacks on corporate targets.
First reported: 26.08.2025 17:001 source, 1 articleShow sources
- The Hidden Risk of Consumer Devices in the Hybrid Workforce — www.darkreading.com — 26.08.2025 17:00
Similar Happenings
Brickstorm Malware Used in Long-Term Espionage Against U.S. Organizations
The UNC5221 activity cluster, attributed to suspected Chinese hackers, has been using the BRICKSTORM malware in long-term espionage operations against U.S. organizations in the technology, legal, SaaS, and BPO sectors. The malware, a Go-based backdoor, has been active for over a year, with an average dwell time of 393 days. It has been used to steal data from various sectors, including SaaS providers and BPOs. The attackers exploit vulnerabilities in edge devices and use anti-forensics techniques to avoid detection. The malware serves multiple functions, including web server, file manipulation, dropper, SOCKS relay, and shell command execution. It targets appliances without EDR support, such as VMware vCenter/ESXi, and uses legitimate traffic to mask its C2 communications. The attackers aim to exfiltrate emails and maintain stealth through various tactics, including removing the malware post-operation to hinder forensic investigations. The attackers use a malicious Java Servlet Filter (BRICKSTEAL) on vCenter to capture credentials, and clone Windows Server VMs to extract secrets. The stolen credentials are used for lateral movement and persistence, including enabling SSH on ESXi and modifying startup scripts. The malware exfiltrates emails via Microsoft Entra ID Enterprise Apps, utilizing its SOCKS proxy to tunnel into internal systems and code repositories. UNC5221 focuses on developers, administrators, and individuals tied to China's economic and security interests. Mandiant has released a free scanner script to help defenders detect BRICKSTORM. The BRICKSTORM backdoor is under active development, with a variant featuring a delay timer for C2 communication. The attackers have exploited Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) for initial access. The attackers have used a custom dropper to install a malicious Java Servlet filter (BRICKSTEAL) in memory, avoiding detection. The attackers have modified init.d, rc.local, or systemd files to ensure persistence on appliances. The attackers have targeted Windows environments in Europe since at least November 2022. The attackers have been linked to other related Chinese threat actors besides UNC5221. The campaign has been monitored by Mandiant since March 2025. The attackers have targeted downstream customers of compromised SaaS providers. The attackers are believed to be analyzing stolen source code to identify zero-day vulnerabilities in enterprise technologies. The attackers use a delay timer to lie dormant on infected systems until a hard-coded date. The malware employs Garble, an open-source tool, for code obfuscation to hide function names, structures, and logic. Brickstorm has been found on VMware vCenter and ESXi hosts, often deployed prior to pivoting to these systems. The attackers use legitimate cloud services like Cloudflare Workers or Heroku for C2 communications. The attackers use dynamic domains like sslip.io or nip.io that point directly to the C2 server’s IP. The attackers favor appliance and management-plane compromise, per-victim obfuscated Go binaries, delayed-start implants, and Web/DoH C2 to preserve stealth. The attackers harvest and use valid high-privilege credentials to appear as routine administrator tasks. The attackers deploy in-memory servlet filters, remove installer artifacts, and embed delayed-start logic to limit forensic traces. The attackers abuse virtualization management capabilities, such as cloning VMs to extract credential stores offline. The attackers deploy an in-memory Java Servlet filter on vCenter to intercept and decode web authentication to harvest high-privilege credentials. The attackers use a SOCKS proxy on compromised appliances to tunnel into internal networks for interactive access and file retrieval.
WhatsApp Zero-Day Exploited in Targeted Attacks
A zero-day vulnerability in WhatsApp (CVE-2025-55177) was exploited in targeted attacks against specific users, chained with a separate iOS flaw (CVE-2025-43300). The flaw allowed unauthorized users to trigger content processing from arbitrary URLs on targeted devices. Apple issued threat notifications to users targeted in mercenary spyware attacks, which included individuals based on their status or function, such as journalists, lawyers, activists, politicians, and senior officials. The attacks highlight the risks of chaining multiple vulnerabilities to compromise targets, emphasizing the need for comprehensive security measures. WhatsApp patched the issue and notified affected users. Apple has sent threat notifications multiple times a year since 2021, alerting users in over 150 countries, including a fourth campaign in France in 2025. The attacks began with the exploitation of the WhatsApp zero-day vulnerability, which was chained with an iOS flaw in sophisticated attacks. Apple has been issuing threat notifications to users targeted in these attacks, advising them to enable Lockdown Mode and seek emergency security assistance. Apple introduced Memory Integrity Enforcement (MIE) in the latest iPhone models to combat memory corruption vulnerabilities, and the number of U.S. investors in spyware and surveillance technologies has increased significantly.
Chinese State-Sponsored Actors Target Global Critical Infrastructure
Chinese state-sponsored Advanced Persistent Threat (APT) actors, specifically the Salt Typhoon group and a newly identified group named RedNovember, have been conducting sustained campaigns to compromise critical infrastructure networks worldwide. The campaigns aim to gain long-term access to telecommunications, government, transportation, lodging, and military networks. This activity has been detailed in a joint advisory by CISA, NSA, FBI, and international partners, including Canada, Australia, New Zealand, the UK, Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, Poland, and Spain. The advisory provides intelligence on tactics used by these actors and recommends mitigations to strengthen defenses. The Czech Republic's National Cyber and Information Security Agency (NUKIB) has issued a warning instructing critical infrastructure organizations to avoid using Chinese technology or transferring user data to servers located in China. The agency has re-evaluated its risk estimate of significant disruptions caused by China, now assessing it at a 'High' level. The NUKIB has confirmed malicious activities of Chinese cyber-actors targeting the Czech Republic, including a recent APT31 campaign targeting the Czech Ministry of Foreign Affairs. The advisory highlights concerns over the transfer of system and user data to China, potentially misused by state, military, or political interests. The Czech government previously accused China of targeting its critical infrastructure through APT 31, an allegation denied by the PRC but condemned by the US, EU, and NATO. The advisory suggests that individuals and organizations consider restricting or prohibiting the use of products and services that transfer data to China. The campaign has targeted at least 600 organizations across 80 countries, including 200 in the U.S. The threat actors have exploited vulnerabilities in Cisco, Ivanti, and Palo Alto Networks devices to gain initial access and have modified routers to maintain persistent access and pivot into other networks. The advisory also notes that the APT actors may target other devices such as Fortinet firewalls, Juniper firewalls, Microsoft Exchange, Nokia routers and switches, Sierra Wireless devices, Sonicwall firewalls, etc. RedNovember has targeted perimeter appliances of high-profile organizations globally, including defense and aerospace organizations, space organizations, and law firms. The group has breached at least two U.S. defense contractors, a European engine manufacturer, and a trade-focused intergovernmental cooperation body in Southeast Asia. RedNovember has used the Go-based backdoor Pantegana and Cobalt Strike as part of its intrusions, along with the Spark RAT and LESLIELOADER. The group has also used VPN services like ExpressVPN and Warp VPN to administer and connect to servers used for exploitation and communication.