Exploiting public-facing applications

The exploitation of public-facing applications (T1190) is rightfully one of the top techniques of initial access. Public-facing applications are any applications that can be accessed from outside an organization’s internal network. This can vary from websites and web applications to cloud-based solutions and services providing remote access. Microsoft Exchange, Citrix NetScaler ADC, NetScaler Gateway, and virtual private network (VPN) and web server applications often become frequent targets for threat actors looking to gain access to an organization’s network. HAFNIUM, Kimsuky, and MuddyWater have been spotted using this technique in their attacks.

To execute exploitation, threat actors might use self-written exploits, publicly available proofs of concept (POCs), or even buy code on dark web forums or marketplaces. Subsequent actions depend on the exploited application, available vulnerability, privileges the attacker receives...