Cyclops Blink turned forgotten firewalls into someone else’s infrastructure

The week

On April 6, 2022, the Justice Department announced something unusual. In March, with authorization from a court, the FBI had reached into network devices it did not own, in offices it had never visited, and removed malicious software from them. The target was a botnet known as Cyclops Blink.

A botnet is a network of computers or devices that have been secretly infected and can be controlled remotely, all together, by whoever planted the infection. The owners usually have no idea. The word comes from “robot network”: thousands of machines taking orders from someone else.

The department said the botnet was controlled by Sandworm, a group US and UK authorities attribute to Russia’s military intelligence service, the GRU. Cyclops Blink was made up of thousands of infected network devices worldwide. Most were WatchGuard firewall appliances, the boxes many organizations put between their internal network and the internet to filter traffic. Some ASUS routers, the kind of device that connects a small office or home to the internet, were also targeted.

What came before

The operation did not come out of nowhere. On February 23, the UK’s National Cyber Security Centre, CISA, the NSA and the FBI had published a joint advisory describing Cyclops Blink as a successor to VPNFilter, an earlier Sandworm botnet. The advisory said the new malware appeared to have been active since at least June 2019. It also said the malware could survive a reboot and the device’s normal firmware update process, so a routine update did not clean an infected box.

VPNFilter itself had been disrupted in May 2018, when the FBI obtained court authority to seize a web domain the malware used to receive instructions. Researchers at Cisco Talos had estimated that VPNFilter had infected roughly half a million routers and storage devices. Cyclops Blink looked like Sandworm’s answer to that setback: a sturdier design, built to keep working after individual nodes were lost.

WatchGuard published detection tools and a step-by-step diagnosis and remediation plan the same day as the advisory. The company estimated that about 1% of its active firewall appliances were affected. It said only appliances configured to allow unrestricted management access from the internet were at risk, and that restricted management access was the default on its physical appliances. The infected devices, by that account, had been opened up by someone after they left the factory. ASUS issued its own guidance for affected router models.

What the operation did

Weeks of public guidance had not been enough. According to the warrant application, as reported at the time, the number of previously identified infected devices worldwide had fallen only about 39% by March 18, 2022, the day a court authorized the operation. Most owners had not acted.

The operation focused on devices in the United States that served as command and control nodes, the relay points the operators used to send instructions to the rest of the botnet. Reporting on the warrant said investigators had found such nodes at 26 internet addresses, 13 of them in the United States. With some owners’ consent, the FBI used access to a few nodes to reach the rest remotely. It copied and removed the malware from the identified nodes and changed firewall rules to close the external management ports the actors had used.

A management port is the door through which an administrator logs in to configure a device; it should not be reachable from the whole internet. The department said the commands used could not search, view or retrieve the owners’ own content. The operation did not touch the thousands of ordinary infected devices. It cut them off from their controllers, and left the cleanup to their owners.

The legal path

Operations like this rest on search warrants. A 2016 amendment to Rule 41 of the Federal Rules of Criminal Procedure made it possible for a judge to authorize remote access to computers in many districts at once in certain botnet investigations. The department had used court-authorized remote action a year earlier, in April 2021, to remove web shells from hundreds of compromised Microsoft Exchange servers in the United States. Cyclops Blink signaled that this would become a regular tool.

For many small public bodies, that was the uncomfortable part of the news. The devices involved were not exotic. They were the kind of box found in a closet at a town hall, a library or a field office, installed years ago and rarely looked at since. The government had stepped in, in part, because many owners had not.

State-sponsored attacks on government are usually pictured as intrusions to steal information or cause disruption: a foreign service breaking into an agency to read its email, or knocking a public service offline. Cyclops Blink illustrated another role.

The infected firewalls and routers were not mainly targets. They were infrastructure: a distributed network of machines the operators could use to relay commands, hide their origin and stage operations elsewhere. Their owners, including small offices and local governments, might never notice.

That reverses the usual risk calculation. A small agency may judge that it holds little worth stealing and spend accordingly. Its internet-facing device can still serve a foreign intelligence service against someone else, and the same weakness that lets a device be borrowed usually lets it be used as a way in.

We take the problem in five parts. First, what the edge is and why an adversary wants it. Second, how edge devices drift out of anyone’s care. Third, what the court-authorized operation could and could not do. Fourth, how the duty differs across federal, state, local and special-purpose public bodies. Fifth, the ownership model that closes the gap, and the strongest objections to it.

Borrowed boxes on the border

Every organization connected to the internet has a border between its own network and the outside world. The equipment on that border is called the edge. It typically includes:

• Firewalls, which inspect traffic going in and out and block what is not allowed;
• Routers, which direct traffic between networks;
• VPN appliances, which let remote staff connect securely to the internal network over the public internet.

In a large agency, these are managed by a networking team and watched by a security operations center. In a small one, such as a rural water district, a branch library or a county field office, they may be a single box installed by a contractor, configured once and left alone. The box keeps working, so nobody thinks about it.

That is the paradox of edge devices. They are among the most exposed pieces of equipment an organization owns, because they face the internet directly, and among the least examined, because when they work they are invisible.

Why the edge suits an intruder

Firewalls, routers and VPN appliances are always on and have public addresses. Many have spare processing capacity. They run specialized operating systems that do not support endpoint detection and response tools, the security software that watches for suspicious behavior on laptops and servers. So a compromise can persist for months unseen.

Their logs, the records of what the device has done, are often kept only on the device itself, overwritten within days, or never reviewed. When an investigator later asks what the box was doing in a given month, there may be no answer.

Cyclops Blink added a further property. The February advisory said it could persist through a reboot and through the device’s own firmware update process. An owner who dutifully installed the latest firmware could still be infected. WatchGuard’s remediation plan therefore went beyond updating, and walked owners through resetting the appliance, installing current firmware and changing credentials. A device that can lie about its own state is a device whose owner needs outside evidence, such as traffic records, to trust it.

Footholds and relays

For a state actor, that combination makes edge devices useful in two ways. They can be footholds into the owner’s network. They can also be relays for operations against other targets, making traffic appear to come from ordinary organizations in many countries.

The relay function is the less familiar one. The effect resembles someone watching a bank from the empty upstairs rooms of a dozen ordinary shops across town: when police look for the watcher, they find florists and dry cleaners. Defenders who block a known hostile address gain little when the next hop is a county water authority’s firewall.

Relays also defeat a common shortcut in defense. Many organizations block traffic from countries where they do no business, or from hosting providers known for abuse. Traffic relayed through a compromised device in an American town arrives from an American address with a clean history. Geography-based blocking and reputation lists are blind to it.

Cyclops Blink appears to have been built mainly for this second purpose, giving its operators a resilient, global network that survived the loss of individual nodes. Take one device offline and the rest carry on. Its design was modular, so new capabilities could be pushed to devices already enrolled.

The awkward phone call

Relays also complicate attribution and response. An agency whose device is used this way may first hear of it from law enforcement, a vendor or a foreign partner. It may then face questions about traffic it never sent, aimed at victims it has never heard of.

That is an awkward conversation for any public official, and a harder one if the agency cannot show basic records of how the device was managed. Who installed it, who held the administrator password, when it was last updated, and whether its management page was open to the internet are the first questions. Many small bodies could not have answered any of them in April 2022.

How a firewall drifts out of anyone’s care

Many public bodies, especially small local governments, special districts, libraries and field offices, run edge devices installed once and rarely revisited. A firewall installed by a contractor years ago may still run its original firmware, the built-in software that makes the device work. Its management interface may be reachable from the internet because that was convenient during setup. Nobody may be assigned to review its alerts or read the maker’s advisories.

Drift rarely comes from a single bad decision. It comes from four ordinary mechanisms.

Ownership split between teams and firms

The February advisory explained that Cyclops Blink had been deployed on devices whose management interface was exposed to the internet, a configuration that is common and avoidable. It is the kind of detail that falls between teams. Networking owns the device, security owns monitoring, and a vendor or managed service provider may have done the installation and kept the credentials.

When responsibility is split three ways, each party can reasonably believe another is watching. The contractor assumes the county reads advisories. The county assumes the contractor does. The state’s security office, if there is one, may not know the device exists.

Inventories that record the wrong things

Asset inventories often list the device by model but not its firmware version, support status, management exposure or the person responsible for it. That kind of inventory satisfies a property audit. It is useless when an advisory arrives naming a model and a firmware range, because nobody can tell from it which boxes are affected.

A useful edge inventory is short and specific. For each device it needs location, model, serial number, firmware version, support end date, whether management is reachable from the internet, who holds administrative credentials, and the named person who acts on advisories. Eight fields, kept current, are worth more than a fixed-asset register of thousands of lines.

Budgets that separate the box from its upkeep

Budget cycles add to the drift. Firewalls are often bought as capital items and expected to last for years. Support subscriptions that deliver firmware updates are operating costs that can lapse unnoticed. A device with an expired subscription may stop receiving fixes without anyone deciding that it should. Nobody signs a memo saying “we will stop protecting the front door.” A renewal notice simply goes unanswered.

One-time funding makes this worse. Hardware bought with grant money or emergency funds arrives without a recurring line for its upkeep. The purchase is celebrated; the third-year renewal falls into a budget that never planned for it. Cooperative purchasing contracts, which let small bodies buy from a state or regional contract, make the purchase easy. They do not, by themselves, buy anyone’s attention for the next five years.

Knowledge that walks out the door

Many small agencies depend on one or two people, or a single contractor, who understand how the network was set up. When they leave, that knowledge often leaves with them. The new IT generalist inherits a working network and no map of it. The administrator password may be in a former employee’s notebook, or only in the contractor’s files.

How the mechanisms combine

Suppose a county installed firewalls at its seven branch libraries six years ago through a regional contractor. The contractor set up remote management so it could fix problems without driving out, which meant the management page was reachable from the internet. Two years later, the support contract was not renewed in a tight budget year.

The county’s IT inventory lists “firewall, WatchGuard, 7 units.” It does not list firmware versions, whether management is exposed, or who holds the administrator password. When a federal advisory names the device type, nobody at the county reads it, because nobody is responsible for reading it.

Nothing in that story is negligent in a dramatic way. Each decision was reasonable in isolation. Together they produce exactly the kind of device a botnet operator looks for.

Now take the same county a year later, after a modest effort. Its inventory lists each library firewall with its firmware version, support status and the name of the county employee responsible. Remote management has been switched off from the internet; the contractor now connects through the county’s own network. Support subscriptions are in the IT operating budget with a renewal date on the calendar.

When a federal advisory arrives, the named owner reads it the same day, checks the list and calls the contractor if action is needed. The total cost was a few days of staff time and a renewal fee. The county has not become a security leader. It has simply stopped being an easy target.

What the court-authorized operation could and could not do

The operation was notable because the government, with court authorization, acted directly on devices it did not own. It removed malware and closed the access path on the command nodes without waiting for owners. The department described the steps as limited and said the commands could not be used to view or collect the owners’ own content.

Why the government acted

The logic is visible in the numbers reported from the warrant application. WatchGuard and ASUS had published tools and instructions in February. By mid-March, most known infected devices were still infected. The operators still controlled a working network, at a time when Russia’s invasion of Ukraine had raised concern about Russian cyber operations against Western targets.

Waiting for every owner to act was not working. Many owners did not know they were affected. Some did not know they owned the device in any meaningful sense. A small number could not be reached at all.

Where the operation stopped

The operation also showed the limits of that approach. It disrupted the command layer. It did not patch, reconfigure or replace the ordinary infected devices, and it did not stop the next campaign from using them. The firewall rules the FBI changed on the command nodes could be undone by anyone who later regained control of those boxes.

Owners still had to remediate, update firmware and fix configurations. A device cut off from Sandworm was still a device with an exposed management page and, possibly, old firmware. It was available to the next actor who found it.

The trade-off in civil terms

There is also a civic question in how the operation worked. The government chose to act on private and public devices, with a judge’s approval, because waiting for every owner was not working. Civil liberties groups have long raised concerns about remote-access warrants, including the risk that a change to a device has unintended effects. The department’s answer was a narrow scope, judicial oversight and public disclosure afterward.

Agencies can accept that reasoning in an emergency without wanting to depend on it. An organization that keeps its own devices clean, current and properly configured is never the one the FBI needs to reach into. It also never has to explain to its own residents why a federal agency changed settings on a town firewall.

Who pays for whose risk

Underneath the legal questions is an economic one. The owner of a compromised relay bears little of the harm it causes. The victims are elsewhere, often in other countries, and the owner’s own service keeps working. The cost of fixing the device falls on the owner, while most of the benefit goes to strangers.

Economists call that an externality, and markets handle it badly. It explains why voluntary guidance moved so few owners in February and March 2022. It also explains why the government reached for a warrant: when the people who could fix a problem have weak incentives to do so, someone else ends up acting for them.

For public bodies, the externality argument cuts more sharply than for private firms. A business can argue that its first duty is to its shareholders. A public body’s duty runs to the public, including the hospital, utility or neighboring government that its borrowed firewall might be used against. Treating the edge as shared infrastructure is part of that duty, and it is a stronger argument in a budget hearing than an abstract appeal to security.

If the call comes

Operations like this usually end with notification. The FBI or a partner tells owners their device was involved, and asks them to finish the cleanup. An agency should know in advance what it will do when that call arrives. A sensible sequence looks like this:

1. Confirm the caller. Verify through a known FBI field office number, because a fake “law enforcement” call is itself a known fraud.
2. Preserve before you wipe. Export the device configuration and whatever logs exist, and record the firmware version, before restoring anything.
3. Follow the maker’s remediation plan. For Cyclops Blink, that meant a reset and fresh firmware, beyond a routine update.
4. Rotate every credential the device held. That includes administrator accounts, VPN keys and any service accounts it used to reach internal systems.
5. Look behind the box. Review internal logs for connections from the device to servers it had no reason to reach.
6. Brief the right people. Legal counsel, the agency head and, where state law or a cyber insurance policy requires notice, the right external parties.

Each step is easier if the inventory and ownership described below exist. Without them, the first hour goes on finding out who has the password.

Different duties for different public bodies

“Government” covers organizations with very different obligations and very different resources. The same firewall, compromised in the same way, lands differently depending on who owns it. Agencies should check with counsel and their oversight body on which rules bind them.

Federal civilian agencies

Federal civilian executive branch agencies operate under the Federal Information Security Modernization Act and CISA’s binding operational directives. In November 2021, a few months before Cyclops Blink, CISA had issued BOD 22-01. It created a catalog of known exploited vulnerabilities and set deadlines for agencies to fix them. That gave federal agencies a forcing mechanism that small public bodies lacked.

Federal agencies also tend to have a security operations center, a network team and an inspector general who audits both. Their gaps usually lie at the margins: field offices, laboratory networks, devices bought by a program office rather than central IT, and systems run by contractors on the agency’s behalf. Directives apply to those systems too, which means the contract has to require the contractor to comply.

State agencies

State agencies follow state law and state IT policy. Some states run networks centrally, with one office managing edge devices for most agencies. Others leave each agency or university to manage its own. A central model makes inventory and patching easier, but it can leave the central office responsible for devices it cannot physically reach. A federated model keeps local knowledge, but makes it harder to answer a simple question such as how many of a given firewall model the state owns.

Counties, cities and towns

Local governments face few direct federal mandates on network devices. Their obligations come from state law, audit findings, cyber insurance underwriting and the grant programs they accept. Their resources vary widely: a large county may have a full security team, while a small town may have one part-time IT person or none.

Federal help exists but has to be requested. CISA offers state and local governments free services such as vulnerability scanning of internet-facing systems, which would flag an exposed management page. The State and Local Cybersecurity Grant Program, created by the Infrastructure Investment and Jobs Act in November 2021, set aside about $1 billion over four years, distributed through state plans. A town that never enrolls in scanning, and never engages with its state’s plan, gets the benefit of neither.

Special districts, utilities, schools and libraries

Special-purpose bodies are often the smallest and least visible. A water or wastewater district may run operational technology, the control systems that run pumps and treatment, behind the same kind of small firewall. For drinking water systems, the America’s Water Infrastructure Act of 2018 required community systems serving more than 3,300 people to assess risks, including cyber risks. An assessment does not manage a device, but it should at least list it.

Schools and libraries face a different funding pattern. The federal E-Rate program has long helped pay for basic firewall service as part of connectivity. That makes the box affordable but does not, on its own, fund someone to read advisories for it.

Law enforcement and justice agencies

Police departments, sheriffs’ offices, courts and prosecutors that access criminal justice information must meet the FBI’s CJIS Security Policy, and are audited against it. That policy reaches into network boundary protection and remote access. For a small police department, a compromised edge device can therefore become a CJIS compliance finding as well as a security incident, with consequences for its access to national databases.

States as a backstop for small bodies

The gap between a well-resourced federal agency and a three-person special district is too wide for guidance alone to close. Several states have responded by offering shared services to local governments: managed firewall or network services on a state contract, statewide vulnerability scanning, or a state security operations center that will watch local logs. Where these exist, joining them is often the cheapest way for a small body to get each of the five routine jobs done.

Shared services carry their own trade-off. The local body gains capacity, but it also hands decisions to an office that may not know its sites or its priorities. Clear agreements about who owns each device, who may change it and who must be told of an incident matter as much here as in any private contract.

What carries across all of them

The common thread is that obligations differ but the device does not. A WatchGuard appliance in a federal field office and one in a library branch carry the same risk. The difference is whether an outside rule forces someone to look at it. Where no rule does, the agency has to create the forcing mechanism itself.

An ownership model, and the objections to it

Looking after an edge device well is not complicated, but it is continuous. It involves a small set of routine jobs that someone has to own, a contract that says who does what, a few measurements, and a budget line. Each piece is cheap. The discipline is in keeping all of them current.

Five routine jobs

Updating the firmware. Makers regularly release new firmware to fix security flaws. Installing it usually means a short outage, so it is scheduled, tested and done out of hours. A device that never gets updated accumulates every flaw found since it was installed.

Controlling who can manage it. Every device has an administrative interface, usually a web page or a command line, through which settings are changed. The safe setup keeps that interface reachable only from inside the organization’s network, or through a specific controlled route such as a jump host, a single tightly controlled computer administrators must go through first. Strong, unique credentials, changed when staff or contractors move on, complete it.

Reading the maker’s advisories. When a flaw is found, the maker publishes a notice explaining which models and versions are affected and what to do. Someone has to be subscribed to those notices and responsible for acting on them. Government advisories from CISA and the FBI belong in the same inbox.

Watching what it does. Devices can send their logs to a central system where unusual activity, such as logins at odd hours or connections to unfamiliar destinations, can be spotted. Small agencies often skip this. Even a basic version, reviewed weekly, is far better than none, and it supplies the evidence an investigator would later need.

Retiring it on time. Every device eventually reaches end of support, the date after which the maker stops releasing fixes. From then on, every newly discovered flaw stays open permanently. Replacement has to be planned and budgeted well before that date.

In a large federal agency, those jobs are spread across teams with formal processes. In a small town, they may all fall to one IT generalist, or to a contractor who visits twice a year. Neither model is wrong. What matters is that each job has a name next to it.

Contracts that assign the work

Most small bodies rely on a managed service provider or installer for their network. The contract is where ownership becomes enforceable. Useful clauses include:

• a duty to monitor maker and government advisories for every device the provider manages, and to act within a stated number of days;
• a monthly report listing each device, its firmware version, support end date and whether management is reachable from the internet;
• a prohibition on internet-exposed management without the agency’s written approval;
• a requirement that administrator credentials are held by the agency as well as the provider, and handed over in full at contract end;
• notice to the agency within a set time of any suspected compromise.

These clauses cost little to add at renewal. They change the provider’s incentives from keeping the network running to keeping it running safely, and they give the agency evidence when an auditor asks.

A first ninety days

An agency starting from nothing can make real progress in a quarter without new staff. A workable sequence:

1. Weeks one and two: find the boxes. Walk every site, ask every contractor for a device list, and compare it with the agency’s public internet addresses. Record the eight fields described earlier.
2. Weeks three and four: close the doors. Turn off internet-reachable management on every device, or route it through a controlled path. Change shared or default administrator passwords, and make sure the agency holds them.
3. Month two: restore upkeep. Renew lapsed support subscriptions, bring firmware current, and point device logs at somewhere they will be kept and read, even if that is a modest central log service.
4. Month three: plan the future. List devices within two years of end of support, price their replacement, and put it into the budget request. Amend the provider contract at the next opportunity.

The order matters. Closing management exposure first removes the specific condition Cyclops Blink exploited, at almost no cost. Replacement takes longest, so it needs to enter the budget cycle early.

Evidence an auditor will ask for

Auditors and oversight bodies tend to ask for the same handful of documents: the current edge inventory with owners, records showing when advisories were received and acted on, firmware and subscription status, the provider’s monthly reports, and any approved exceptions for remote management. An agency that can produce those within a day has a defensible story even if something goes wrong. One that cannot will find the conversation turning from what the attacker did to what the agency failed to do.

Four numbers worth reporting

An agency head does not need technical detail. Four numbers, reported quarterly, show whether the edge is under control. The first is the share of edge devices with a named owner. The second is the number with management reachable from the internet. The third is the median days from a relevant advisory to action. The fourth is the number of devices within twelve months of end of support, and whether replacement funding has been identified. A rising number in any of those is a decision for leadership, not for the IT generalist alone.

Why agency heads should care

Edge devices can look like a technical housekeeping issue, but they touch things agency heads care about directly. Residents expect public bodies to look after public equipment, and learning that a town’s firewall relayed a foreign intelligence operation undermines confidence whatever the actual harm. Public bodies are part of shared infrastructure, and a compromised device can be used against hospitals, utilities or other governments.

Continuity matters too. For a small agency, the firewall at a branch office may be the only thing connecting staff to payroll, permits, case files or dispatch. Pulling it out of service suddenly while an investigation runs can stop public-facing work for days. When something goes wrong, auditors, oversight bodies and the press will ask who owned the device and why its management page was open. Clear answers protect the agency and the officials responsible.

The objections, taken seriously

“We have nothing worth stealing.” The device is the asset. Its value to an adversary does not depend on what is behind it. And a device that can be borrowed can usually be used as a door, so the assumption fails on its own terms.

“Our contractor handles it.” Perhaps. Unless the contract says so, with deadlines and reports, nobody may be reading advisories. Delegating the work is fine; delegating the knowledge of whether it was done is not.

“Remote management saves us money.” It does. A contractor who can fix a branch firewall without driving there costs less. The answer is to keep remote management but route it through a controlled path, such as a VPN or jump host on the agency’s side, not to expose the management page to everyone.

“Replacement is expensive.” Unplanned replacement is expensive. Planned replacement, spread across a five- to seven-year cycle and known two budget years ahead, is a modest recurring cost. The expensive version is replacing every unit in a week because an advisory or an investigator forces it.

“Zero trust makes the perimeter irrelevant.” Zero trust architectures reduce how much a network trusts anything because of where it connects from. They do not remove the boxes at the border, and some of those boxes are themselves the access gateways that zero trust relies on. The edge changes shape; it still needs an owner.

“Cloud-managed security services remove the problem.” Moving firewall functions to a provider’s cloud does shift patching to the provider, and that can be a sound choice for small bodies. It does not remove local routers, it introduces a dependency on one provider’s security, and it still needs someone at the agency to manage accounts and review reports. The ownership question moves; it does not disappear.

The strongest objection is about capacity. A town with no IT staff cannot run a weekly log review. That is fair, and it is why the minimum is so small: a list, a closed management page, a current subscription, a named person who reads advisories, and a replacement date. Those five things fit within the capacity of almost any public body, especially with state or federal help.

Questions for the call nobody wants

• How many firewalls, routers and VPN devices do we have, including at remote sites, and who is the named owner of each?
• For each one, what firmware is it running, is it still supported by its maker, and is our support subscription current?
• Can any of them be managed from the open internet, and if so, what protects that access?
• Does our managed service contract require the provider to act on advisories within a set time and to report firmware levels to us?
• If the FBI called tomorrow to say one of our devices had been used in someone else’s attack, could we show how it was configured and managed?

With hindsight

Cyclops Blink was an early example of a pattern that intensified. What looked in 2022 like an unusual intervention against a single botnet turned out to be one chapter in a longer story about the edge of the network.

Directives for federal agencies

In June 2023, CISA issued Binding Operational Directive 23-02. It required federal civilian agencies to take management interfaces on network devices off the public internet or place them behind zero trust access controls. Zero trust checks every user and device each time, rather than trusting anything because of where it connects from. The directive addressed, for federal agencies, exactly the configuration Cyclops Blink had exploited.

CISA also issued emergency directives when specific edge products came under attack. In September 2025, Emergency Directive 25-03 ordered agencies to identify and mitigate potential compromise of Cisco ASA and Firepower firewall devices, after an advanced actor exploited previously unknown flaws in them.

On February 5, 2026, CISA went further with BOD 26-02, on end-of-support edge devices. It gave federal civilian agencies three months to inventory devices on a CISA list of unsupported edge devices, and twelve months to decommission those already out of support. Within eighteen months, all identified unsupported edge devices must be gone. Within two years, agencies must have continuous discovery in place. The retirement job described above, for federal agencies, became a requirement with dates.

More botnets, more takedowns

Court-authorized operations against device botnets became routine. In January 2024, the Justice Department announced a December 2023 operation against the KV Botnet, which Volt Typhoon, a Chinese state-sponsored group, had built mostly from end-of-life Cisco and Netgear small office routers. The department warned that a router restarted without mitigation could be reinfected.

In February 2024, the department announced an operation against a botnet of Ubiquiti EdgeRouters that Russia’s GRU had taken over after criminals first infected them with Moobot malware. Different actor, same raw material.

In September 2024, the FBI and allied agencies described a botnet of more than 260,000 routers, cameras and other devices controlled by a China-based company. In May 2025, the FBI warned that criminals were exploiting end-of-life routers to sell access as proxy services, and authorities took down two such services. Ordinary, unwatched devices had become a commodity, rented to whoever paid.

From relay to front door

Exploitation of VPN appliances and firewalls from several major vendors also became a recurring route into organizations, sometimes before fixes existed. The edge had stopped being a mere relay; it was often the way in. In February 2025, cyber agencies from the Five Eyes countries published joint guidance on securing edge devices, citing an increase in targeted attacks on them.

What held up and what didn’t

The core diagnosis held up: unmanaged edge devices with exposed management and lapsed support are what state and criminal botnets are built from. Government disruption kept happening and kept being partial, as the KV Botnet warning about reinfection showed.

The hope that federal help would steadily fill the gap for small local bodies looks weaker in 2026. CISA’s funding agreement for the Multi-State Information Sharing and Analysis Center was allowed to expire on September 30, 2025, and the center moved to a fee-based model. The State and Local Cybersecurity Grant Program reached the end of its original authorization in 2025 and relied on short-term extension. The smallest bodies, the ones with the oldest boxes, are as much on their own as ever. Federal directives now set a clear standard for federal agencies; nothing comparable binds a county library.

By this point in 2026, edge device inventory, management exposure and end-of-life replacement are core expectations in public sector security frameworks. The devices installed and then forgotten remain the problem. For smaller public bodies, the security conversation can still start with a list of boxes, a named owner for each, a closed management door and a replacement date.