Tip: get firewall, VPN and wireless-controller management interfaces off the internet, and rotate the LDAP bind accounts stored on them
- Inventory: search Shodan, Censys or your own attack-surface tool for your FortiGate, FortiWeb, GlobalProtect and Aruba management pages. Attackers like k0t build target lists the same way.
- Restrict: put admin GUIs and CLIs on a management VLAN or allow them only from admin jump hosts, as HPE recommends for the new AOS flaws.
- Harden logins: remove default and shared admin passwords, require MFA on VPN portals, and lengthen lockouts. Investigate lockout bursts instead of just clearing them.
- Assume configs leak: appliance configs often hold LDAP/AD bind passwords that can be decrypted. Use a low-privilege bind account, rotate it, and alert when it logs in anywhere but the appliance.
Sources: HPE Networking advisory HPESBNW05162 (CSAF text, Oct 22) · Group-IB and NyxLab: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge (Oct 21)