IPA warns VPN devices exploited in network-penetration attacks
Japan's IPA warns that critical VPN device vulnerabilities are being actively exploited for network penetration and to establish operational relay boxes (ORBs) for further attacks.
Japan's Information-technology Promotion Agency (IPA) issued an advisory on October 31, 2025, warning that critical vulnerabilities in VPN devices and network boundary equipment are being actively exploited in network-penetration attacks. The agency reports that compromised devices are being weaponized as Operational Relay Boxes (ORBs) — attacker-controlled relay points used to stage attacks against other organizations. IPA notes these compromised devices may be incorporated into botnets and retained as persistent footholds for internal reconnaissance and future attacks during potential conflict scenarios, referencing warnings from Western government agencies.
The advisory warns of severe consequences including unauthorized network access, data theft, reputational damage, litigation, and business disruption. Affected organizations risk becoming unwitting participants in attacks against third parties. IPA recommends immediate patching of vulnerable devices, retiring end-of-life equipment, restricting external access to management interfaces, implementing Attack Surface Management (ASM) to monitor for suspicious relay traffic, and maintaining segmented networks with layered defenses. The agency specifically highlights vulnerabilities in Fortinet, Palo Alto Networks, Ivanti, Cisco, and SonicWall products as examples of flaws being exploited in these campaigns.
IPA is requesting organizations that detect suspicious access to network devices to report incidents and cooperate with Japan's cyber situational awareness activities. The agency emphasizes the need for business continuity planning alongside technical security measures to manage the crisis-level risks posed by these network-penetration attacks.
Detection guidance
External Network Access to VPN/Firewall Management Interface
Detects inbound connections from external/untrusted network zones directly to VPN or network appliance management interfaces (web admin, SSH, or API ports), consistent with exploitation of internet-exposed management panels reported in ORB-based VPN attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Access to VPN Management Interface
logsource:
category: firewall
product: network
detection:
selection:
dst_port:
- 443
- 4443
- 8443
- 10443
- 943
- 22
src_zone: external
dst_zone: management
action: allow
filter:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate remote administration from an approved external management VPN or jump
host
- Vendor support access temporarily allowed through firewall rules
level: medium
tags:
- attack.t1133
- attack.initial-access
id: 9d20591e-2524-57eb-8286-6e8e6f12ba62
status: experimental
author: Vorant
Network Appliance Generating Diverse Outbound Relay Connections (Possible ORB Activity)
Detects a VPN or network boundary device initiating outbound connections to many distinct external destinations on common web ports, a pattern consistent with the device being repurposed as an Operational Relay Box (ORB) to proxy traffic for further attacks. Investigate when the same source device connects to an unusually high number of unique external destinations within a short time window (threshold to be tuned per environment, e.g. >50 distinct destination IPs/hour). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Device Outbound Proxy-Like Relay Traffic
logsource:
category: network_connection
product: network
detection:
selection:
src_category: network_device
dst_port:
- 80
- 443
- 8080
direction: outbound
filter:
dst_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate cloud management or telemetry connections from the appliance to vendor
cloud services
- CDN or software update traffic originating from the device
level: medium
tags:
- attack.t1090
- attack.command-and-control
id: 0840474e-eaad-5bd4-9b1f-7ded5154e83c
status: experimental
author: Vorant
Internal Network Scanning Originating from VPN/Boundary Device
Detects a VPN or perimeter network device initiating connection attempts to multiple internal hosts across common administrative and lateral-movement ports (SMB, RDP, SSH, WinRM), indicating the compromised appliance is being used for internal reconnaissance after initial exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VPN Appliance Internal Host Discovery Scanning
logsource:
category: network_connection
product: network
detection:
selection:
src_category: network_device
dst_port:
- 22
- 445
- 3389
- 135
- 5985
direction: internal
filter:
dst_ip|cidr:
- 10.0.0.1/32
condition: selection and not filter
falsepositives:
- Legitimate network management or vulnerability scanning tools operating from the
same subnet as the VPN appliance
- Scheduled configuration backup or monitoring jobs polling internal hosts
level: medium
tags:
- attack.t1018
- attack.discovery
id: 5fa8d36c-4afc-5a27-a994-28030c90e969
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251031_vpn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free