Things Dream says the chain in the firewall campaign leaves behind:

• Network: bursts of crafted multipart POSTs with very long filenames and session.upload_progress data to the appliance's PHP management server, about 900 MB in total across two memory-exhaustion stages. A leaked pointer comes back in a Set-Cookie header. Crashes or reboots of the management process after such traffic are themselves a signal.
• Privilege escalation: Fragnesia (CVE-2026-46300, XFRM ESP-in-TCP page-cache write) overwrites /etc/pam.d/su so it uses pam_permit.so, which lets su root work without a password. Compare that file against a known-good copy.
• Persistence: a 103-byte PHP webshell in a publicly reachable web directory, verified with id, plus an 8-port reverse SSH tunnel wrapped in a systemd service and an rc.local hook, forwarding LDAP, LDAPS, RDP, the firewall manager, VPN and a SOCKS5 proxy.
• Identity: LDAP enumeration of every user and group, password spraying and new user or machine accounts coming from a firewall management server, and access to Keycloak signing material. Check lockoutThreshold and ms-DS-MachineAccountQuota on the domain.

The attacker also ran about 240 automated probes over two hours against a crashed device, so repeated health checks to a management interface from one external source are worth a look.