2026-06-25 –, Track 3
Edge devices sit on the Internet-facing border of every organisation, silently bridging trust zones while running full Linux distributions that rarely see a reboot, let alone a patch. Because they are “just network kit,” they are exempted from EDR, and excluded from MDM, making them the perfect beachhead for an attacker who wants to pivot into a company's network without triggering a single alert.
This talk will examine various aspects of edge-device compromises. We will share real-world findings and experiences from responding to an edge-device compromise, highlighting the challenges, lessons learned, and best practices for forensic analysis and incident response. We will also explore detection opportunities and recommendations for improving monitoring and response capabilities.
Attendees will leave with actionable incident-response tactics and detection-engineering clues for spotting and stopping similar intrusions.
Mathieu is a Principal Incident Responder at CERT-EU. He has solid experience in responding to high-profile incidents involving Advanced Persistent Threats (APTs) and cyber espionage. In addition to his incident response duties, he leads the detection engineering effort, leveraging his technical expertise to identify and mitigate previously uncovered threats. Mathieu was a speaker at the 36th Annual FIRST Conference in Fukuoka, Japan and at the Hack.lu 2024.
Maël is a security engineer, currently serving as Principal Incident Responder at CERT-EU. He has solid experience in responding to high-profile incidents involving Advanced Persistent Threats (APTs) and cyber espionage. In addition to his incident response duties, he leads the threat hunting effort, leveraging his technical expertise to identify and mitigate previously uncovered threats. Mael is also a key contributor to the detection engineering team, driving the development of innovative solutions to enhance threat detection capabilities. Mael was a speaker at the Underground Economy Conference 2025 in Strasbourg, France and at the State of Statecraft 2025 Conference in Brussels, Belgium.