Industry
Energy and utilities
Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
Read more
Attack technique
Exploit Public-Facing Application
Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network.
In short
Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. The weakness can be a software bug, a temporary glitch or a misconfiguration. It is an Initial Access technique.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Initial Access · Step 3 Of 15 In The Attack Chain
- MITRE IDT1190ATT&CK technique
- Detection4ways to spot itWatch server processes · Check outbound connections
- Defences4ways to stop itPatch and scan regularly · Expose only what is needed
How it works
Any system that accepts connections from the Internet can be a target. Websites and web servers are common, but so are databases, services such as SMB or SSH, and the management interfaces of network devices.
The attacker sends input that the system does not handle safely, or finds a service that was exposed by mistake. If this works, they get a first foothold without needing a stolen password or a phishing email.
If the application runs in the cloud or in a container, the break-in can reach the underlying instance or container, and from there cloud interfaces or weak access policies. Edge appliances are also targeted, because they often cannot run strong host-based defenses.
A real example
Procedure examples listed by MITRE ATT&CK:
- BOLDMOVE is associated with exploitation of CVE-2022-49475 in a network device operating system.
- COATHANGER is installed after exploitation of a vulnerable firewall device.
- Qilin has been delivered through exploitation of exposed applications and interfaces, including remote desktop services.
- Siloscape runs after the attacker gains initial access to a Windows container using a known vulnerability.
- SoreFang can gain access by exploiting a vulnerability in an SSL VPN product that allows malicious update binaries to be placed and delivered.
Who uses it
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Ransomware group DarkSide DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Inactive · Since 2020 · Ransomware as a service
- Ransomware group Hive Hive was a ransomware as a service operation active from June 2021. Disrupted · Since 2021 · Ransomware as a service
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group Vice Society Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022). Since 2021 · Not stated in the advisory
Seen in incidents
- Incident COATHANGER malware on a Dutch Defence network, published February 2024 COATHANGER is advanced Chinese malware that the MIVD and AIVD found on an isolated Dutch Ministry of Defence research network. 2023 · Government and public sector
- Incident Emennet Pasargad hack-and-leak and information operations against Israel, 2020 to 2024 Emennet Pasargad is an Iranian group that the FBI says has run hack-and-leak and information operations, mainly against Israel, since at least 2020. May 2020 to October 2024 · Multiple sectors
- Incident ESXiArgs ransomware campaign against VMware ESXi servers In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched. February 2023 · Multiple sectors
- Incident Microsoft Exchange ProxyLogon mass exploitation, 2021 The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world. March 2021 · Multiple sectors
- Incident MirrorFace campaigns against Japan, 2019 to 2025 On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese organizations since about 2019 were run by an actor called MirrorFace. 2019 to 2025 · Government and public sector
- Incident Salt Typhoon telecom intrusions From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries. October 2024 · Telecommunications
- Incident SharePoint ToolShell attacks In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. July 2025 · Multiple sectors
- Incident UNC3886 campaign against Singapore’s telecommunications operators, 2025 In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecommunications operators. 2025 · Telecommunications
How to detect
-
Look for odd requests and error spikes
Unusual request patterns to a public endpoint, or a rise in server errors and firewall blocks, can be the first sign.
-
Watch server processes
A web server or application process that suddenly starts a shell, loads unexpected modules or writes new files is a strong warning.
-
Check outbound connections
A public-facing host or container that starts connecting to new outside addresses, or to the cloud metadata service, may be compromised.
-
Detection strategy MITRE lists
DET0080, Exploit Public-Facing Application, multi-signal correlation (request, error, post-exploit process and egress).
How to defend
-
Patch and scan regularly
Update exposed applications on a regular schedule, scan external systems for weaknesses, and fix critical ones quickly.
-
Expose only what is needed
Make sure every public service is meant to be public, and restrict access to anything that should be internal only.
-
Separate and contain
Place external servers in a DMZ or on separate hosting, isolate the application, and give service accounts only the access they need.
-
Filter traffic in and out
Use web application firewalls to limit exploit traffic, and restrict outbound traffic from public servers to limit what an attacker can do after a break-in.
Questions
What is Exploit Public-Facing Application?
It is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. The weakness can be a software bug, a temporary glitch or a misconfiguration. It is an Initial Access technique.
Which systems are targeted?
Websites and web servers are common, but so are databases, services such as SMB or SSH, and the management interfaces of network devices. Edge appliances are also targeted because they often cannot run strong host-based defenses.
How can defenders detect it?
Unusual request patterns to a public endpoint, or a rise in server errors and firewall blocks, can be the first sign. A web server process that suddenly starts a shell, or a public host that makes new outbound connections, is a strong warning.
How do I reduce the risk?
Patch exposed applications on a regular schedule, scan external systems and expose only what must be public. Place external servers in a DMZ, use web application firewalls and restrict outbound traffic from public servers.
In our research
- GRU targeting of logistics firms: advisory AA25-141A October 2026
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- ATT&CK groups by attributed origin: what is mapped October 2026
- KEV: days from CVE publication to listing, 2024 to 2026 October 2026
- KEV weakness classes: which CWEs recur, 2024 to 2026 October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.