Tenable and SentinelOne analysis finds state and criminal actors converge on same edge infrastructure

Tenable and SentinelOne have published a joint analysis of 93 CVE-actor attribution pairs showing that state-sponsored threat actors and financially motivated criminal groups independently converge on the same edge infrastructure. The two datasets, Tenable exposure telemetry and SentinelOne DFIR casework, converge 79% on the same vendor attack surfaces despite minimal CVE-level overlap.

Twelve CVEs in the combined dataset have confirmed multi-nexus attribution across five nexus categories, including examples such as CVE-2024-3400 exploited by both a China-nexus actor and INC Ransomware. The analysis highlights that F5 customers are the most broadly exposed, with 53.8% having at least one actively exploited CVE, while Citrix shows the slowest remediation at a median of 461 days to patch.

The report recommends patching F5 and Citrix devices immediately, auditing Ivanti deployments, and implementing edge-device-specific patch SLAs.