Is this a substitute for HKCERT?

No. HKISG bulletins are membership-programme early warnings. For national CERT coordination use HKCERT . See also HKCERT and HKISG .

What should we do in the next 24 hours?

Confirm exposure, apply the mitigations listed above, raise monitoring, and brief decision makers with a dated one-page note. Use Incident Response Basics if your playbook is incomplete.

22 Jul 2026

Critical: Edge management exposure pattern observed in HK scans

Q: What risk level does this bulletin carry?

Current bulletin risk label: high . HKISG high-risk bulletin: internet-facing firewall and VPN management interfaces remain exposed on Hong Kong IPs — isolate admin planes, enforce MFA, and review auth logs within 72 hours.

HKISG high-risk bulletin: internet-facing firewall and VPN management interfaces remain exposed on Hong Kong IPs — isolate admin planes, enforce MFA, and review auth logs within 72 hours.

Summary

HKISG telemetry and member reports continue to show exposed firewall / VPN management interfaces on public Hong Kong IPs. Attackers chain these with known CVEs for initial access, then move laterally into identity and backup systems.

Risk label: high. Treat internet-reachable management planes as active attack surface until proven otherwise.

Who is affected

Organisations running edge firewalls, SSL VPNs, or SD-WAN controllers with management UI on 0.0.0.0/0
MSPs managing customer appliances without jump-host or allowlist controls
Teams that “temporarily” opened admin ports for a vendor and never closed them

Why this matters now

Exposed management planes compress attacker timelines. Credential stuffing, default passwords, and unpatched CVEs convert a scanning hit into ransomware staging within hours. Trust Reviews and buyer diligence increasingly ask whether admin paths are internet-reachable.

Recommended actions (priority order)

Confirm management planes are not reachable from the open internet — prefer private management networks or ZTNA
Enforce MFA and IP allowlists for any remaining admin paths
Patch to vendor-fixed builds within 72 hours of a relevant advisory
Review auth logs for anomalous admin sessions, new local users, and config exports
Rotate credentials and certificates if exposure window is uncertain
Validate backup integrity and offline copies after any suspected admin compromise

Evidence to retain

Screenshots of ACL / security-group rules before and after change
Ticket IDs for patch jobs
Log extracts covering the exposure window

These artefacts matter if you later enter an Trust Review.

Credential-stuffing bulletin
Incident Response Basics
Glossary: Firewall, VPN-related authentication
Methodology — protective controls and detection domains

Status

Active. Members should report recurring exposure clusters via Contact so Programme Council can update aggregate outlook notes without naming victims.

Frequently asked questions

What risk level does this bulletin carry?: Current bulletin risk label: high. HKISG high-risk bulletin: internet-facing firewall and VPN management interfaces remain exposed on Hong Kong IPs — isolate admin planes, enforce MFA, and review auth logs within 72 hours.
Is this a substitute for HKCERT?: No. HKISG bulletins are membership-programme early warnings. For national CERT coordination use HKCERT. See also HKCERT and HKISG.
What should we do in the next 24 hours?: Confirm exposure, apply the mitigations listed above, raise monitoring, and brief decision makers with a dated one-page note. Use Incident Response Basics if your playbook is incomplete.