AI Defense Against RedNovember’s Edge-Device Attacks

Most organizations still treat VPNs, firewalls, and email gateways like “set-and-forget” plumbing. RedNovember’s campaign shows why that mindset is expensive.

Recorded Future’s Insikt Group assessed RedNovember (previously TAG-100; overlapping with Storm-2077) as highly likely a Chinese state-sponsored cyber-espionage group that spent June 2024 through July 2025 hunting for openings in internet-facing edge devices—and then using largely open-source tooling (Pantegana, SparkRAT) plus Cobalt Strike to operate across government, defense, and technology targets.

For this AI in Defense & National Security series, I want to pull one thread hard: RedNovember isn’t “advanced” because of exotic malware. It’s effective because it’s fast, scalable, and disciplined about living on the edge. That’s exactly the kind of problem where AI-driven cybersecurity helps—if you deploy it with the right expectations and the right telemetry.

Why RedNovember’s playbook keeps working

RedNovember’s approach succeeds for two blunt reasons: edge devices are exposed and edge visibility is weak.

The report describes reconnaissance and likely compromise attempts against a familiar list of perimeter technologies: SonicWall, Cisco ASA, F5 BIG-IP, Palo Alto Networks GlobalProtect, Sophos SSL VPN, Fortinet FortiGate, Outlook Web Access (OWA), and Ivanti Connect Secure (ICS). These systems sit where defenders have the least patience (maintenance windows are painful) and attackers have the most leverage (one foothold can open an internal network).

Two operational patterns stand out.

Pattern 1: Exploit speed beats bespoke malware

RedNovember repeatedly aligned activity with freshly disclosed vulnerabilities and public proof-of-concept (PoC) exploits. When PoC code drops, exploitation attempts spike. That’s not a theory; it’s an observable rhythm across multiple campaigns.

This matters because it flips the usual security narrative:

• You don’t need “nation-state zero-days” to cause nation-state damage.
• The decisive factor is often time-to-patch and time-to-detect, not sophistication.

Pattern 2: Open-source tools create plausible noise

The group used:

• Pantegana (Go-based, multi-platform backdoor / C2 framework)
• SparkRAT (open-source RAT)
• Cobalt Strike (commercial red-team tool widely abused by attackers)
• LESLIELOADER (a Go-based loader used to run payloads in memory)

Open-source and dual-use tools create a practical problem for defenders: your detections can’t rely on “rare malware” signals. If your SOC only lights up for unique binaries, you’ll miss the intrusion and only catch the cleanup.

What the targeting says about national security risk

The victimology in the report reads like a map of strategic priorities: government ministries, diplomatic organizations, defense contractors, space and aerospace research, Taiwanese technology organizations (including semiconductor-adjacent entities), and law firms.

A few examples from Insikt Group’s observations illustrate why this belongs in defense and national security conversations—not just IT risk reviews:

• Reconnaissance near geopolitical events: Activity in Taiwan was observed in proximity to Chinese military exercises around Taiwan in December 2024, including communications to a location near a Taiwan Air Force airbase and a hub for semiconductor R&D.
• Panama scanning surge: Between April 22–24, 2025, RedNovember scanned and likely reconnoitered 30+ Panamanian government organizations, shortly after high-profile US–Panama security discussions tied to the Panama Canal.
• Defense industrial base pressure: The report notes reconnaissance and targeting activity involving US defense contractors and a specialized US engineering and military contractor during an ICS VPN-focused campaign.

Here’s the stance I’ll take: edge-device exploitation is now a strategic collection method, not just a cyber tactic. It scales. It’s quiet. It lets an actor “pre-position” access across many organizations and then pick which footholds to operationalize later.

How AI-driven cybersecurity can stop this earlier (and where it can’t)

AI can’t patch your VPN. It can’t magically add logs your appliance doesn’t generate. But AI can change the economics of detection and response in three places RedNovember depends on: exposure awareness, anomaly detection, and operational tempo.

1) AI for exposure management: knowing what you actually have

RedNovember’s targeting list is long because most enterprises have more edge surface than they think—old portals, forgotten OWA instances, vendor VPNs, “temporary” test systems that became permanent.

AI-powered exposure management helps by continuously reconciling:

• Internet-facing assets (domains, IPs, certificates)
• Product fingerprints (what VPN/firewall/email stack is exposed)
• Risk signals (known exploited vulnerabilities, PoC availability, active scanning)

The practical win: you stop arguing about whether an appliance exists and start prioritizing which exposures need action this week.

2) AI for edge anomaly detection: catching the “gray” activity

The report distinguishes compromise vs. targeting vs. reconnaissance vs. “browsing.” Defenders face the same ambiguity. The difference is that defenders have to spot it across thousands of events.

AI detection is valuable when it learns normal patterns for edge services and flags deviations such as:

• Unusual authentication sequences (spray-like behavior, impossible travel, weird user agents)
• Rare administrative actions (config exports, new admin users, changes to VPN realms)
• Exploitation-adjacent web patterns (odd URL paths, suspicious file reads, abnormal POST bodies)
• Unexpected outbound connections from edge devices (C2-like beacons, new destinations, odd ports)

Important constraint: if your edge devices don’t send usable logs, AI won’t save you. You’ll need compensating telemetry: network flow, DNS, proxy, EDR on jump hosts, and packet-based detections at chokepoints.

3) AI for threat intelligence triage: compressing the PoC window

RedNovember appears to move quickly after PoC publication (for example, activity aligned with Check Point VPN gateway exposure after CVE-2024-24919 PoC release, and earlier behavior aligned with Palo Alto GlobalProtect CVE-2024-3400).

AI-driven threat intelligence helps by automatically correlating:

• “PoC just dropped” signals
• “exploitation in the wild” signals n- your asset inventory (do we run it? where?)
• your compensating controls (WAF rules, IPS signatures, VPN hardening)

The practical win: you can trigger a playbook in hours, not days—especially critical during holiday periods, when staffing is thin and attackers know it.

A useful rule for 2025: assume public PoC means mass scanning within 24–72 hours for widely deployed edge products.

A defensive blueprint for government, defense, and critical tech

If you’re responsible for defense, aerospace, government IT, or a supplier in that orbit, here’s a pragmatic approach that aligns with how RedNovember operates.

Step 1: Treat edge devices like Tier-0 assets

Edge appliances are often excluded from the same rigor you apply to servers. Flip that.

• Put VPNs, firewalls, load balancers, and email gateways under strict change control
• Enforce MFA everywhere it’s supported
• Restrict admin interfaces to internal networks or dedicated management planes
• Rotate credentials and audit admin roles regularly

Step 2: Build a “PoC-to-mitigation” runbook

When a PoC appears for an edge product you run, you need an automatic motion that answers:

1. Do we have the product exposed to the internet?
2. Are we vulnerable (version/config)?
3. Can we patch now? If not, what’s the compensating control?
4. What detections should we turn on immediately?
5. What hunting queries should run for the next 14 days?

AI helps most on steps 1–4 by reducing manual lookup work and by recommending actions based on observed exploitation patterns.

Step 3: Detect the tools RedNovember relies on

Because the toolchain includes common frameworks, focus on behaviors and high-signal indicators:

• Cobalt Strike-like traffic patterns (beacon intervals, metadata shapes, suspicious HTTP paths)
• Go-based malware traits (process behaviors, unusual parent/child relationships, in-memory execution)
• Loader activity (unsigned executables spawning unusual processes, memory injection patterns)
• New outbound connections from devices that shouldn’t “browse the web” (edge appliances visiting certificate transparency sites, file-sharing services, scanning tools)

A lot of teams miss that last one. In the report, RedNovember infrastructure interacted with services such as file-sharing and scanning platforms. Your edge device should not look like a curious human.

Step 4: Plan for “assume breach” segmentation

RedNovember’s edge focus is a reminder that perimeter compromise is inevitable over time. Segmentation reduces the blast radius.

• Separate VPN user access from sensitive enclaves
• Use just-in-time access for admin functions
• Require strong device posture checks for privileged access
• Monitor lateral movement attempts aggressively

AI-based detection can amplify this by spotting abnormal east–west traffic and privilege escalation patterns after an initial foothold.

People also ask: what makes RedNovember different from typical APT campaigns?

It scales like a criminal operation but pursues espionage objectives. RedNovember repeatedly targeted wide sets of organizations and edge products, then used broadly available tooling to maintain operational flexibility.

It’s opportunistic about initial access and selective about follow-on actions. The initial edge targeting can look noisy or generic; the value comes from deciding later which footholds align with strategic intelligence requirements.

It benefits from defender blind spots. Edge devices often lack strong endpoint telemetry, are patched slower, and are harder to instrument. That’s why attackers keep coming back.

What to do next if you suspect edge-device targeting

If your organization sits in government, defense, aerospace, space, or high-value tech, assume you’re on the scanning lists and act accordingly.

1. Inventory and validate every internet-facing edge service (VPN, OWA, gateways, load balancers). Remove what you don’t need.
2. Prioritize patching for edge RCE vulnerabilities—especially those with public PoC and observed exploitation.
3. Turn on network-based detections for C2 patterns and unusual outbound behavior from appliances.
4. Hunt for post-exploitation artifacts: web shells, new admin accounts, suspicious scheduled tasks, abnormal authentication paths.
5. Adopt AI-assisted triage for vulnerability intelligence and alert correlation so your team can move at attacker speed.

Defense and national security programs talk a lot about AI for intelligence analysis and autonomous systems. Cybersecurity is the more immediate battleground: AI-driven security operations are how you keep up when adversaries can scan the internet faster than humans can read patch notes.

If RedNovember’s approach becomes the default—and it’s heading that way—the question for 2026 isn’t whether you’ll see edge probing. It’s whether your detection and response can keep pace when the next PoC hits on a Friday night.