The shift from initial access via credential reuse to repurposing firewalls as persistent credential-harvesting nodes creates a compounding risk where compromised perimeter devices actively expand the attack surface. This self-feeding pipeline suggests defenders must treat any anomalous authentication success on a firewall not just as a breach, but as a potential indicator of an automated botnet expanding its foothold.

Internet accessible management interface of firewall. There sure is a bleed to this. Eyes of every security engineer bleeding at the absolute stupidity of such a decision.