Virtual appliances play a critical role in cloud networks, providing services such as firewalls, secure gateways, and VPN connectivity. Yet, because they operate as "black boxes" that don't support traditional EDR agents, they have historically been a massive visibility gap for security teams. Over the past months, Wiz’s Agentless Workload Detection has fundamentally changed this pattern. Not only does it provide critical visibility into virtual appliances, but it also gives our research and IR teams the context needed to investigate activity associated with high-profile threat actors..This allows us to detect and analyze a wide array of sophisticated attacks, all without the need for agents.
In this blog post, we’ll show you a subset of the unique value this new capability has unlocked, across a breadth of threats and targeted technologies.
The FortiGate Campaign Trail
FortiGate devices are high-value targets because they are often internet-facing and operate as trusted gateways between external and internal networks. Our agentless approach allowed us to track several critical exploitation patterns over the past months:
CVE-2026-24858 Exploitation: We observed attackers exploiting this zero-day to create local super-user accounts and modify different settings, enabling lateral movement and greater impact.
Credential Stuffing & FortiBleed: We detected coordinated credential stuffing campaigns leveraging botnets to target exposed admin panels. This aligns with the broader FortiBleed campaign, which compromised approximately 75,000 devices globally.
Configuration Theft: Attackers were caught downloading full device configurations. Because FortiOS uses reversible encryption for stored credentials, these stolen configs allowed actors to decrypt LDAP service accounts and VPN pre-shared keys to facilitate lateral movement.
Redis: Beyond Simple Cron Jobs
While Redis is secure by default when properly configured, exposed or misconfigured deployments are still frequently targeted in cloud environments. Most exploitation attempts remain primarily profit-driven, specifically via cryptojacking. By agentlessly monitoring Redis logs, we have successfully detected real-world attackers abusing these instances in the wild.
We have observed several cases where attackers abuse methods like replication abuse (using REPLICAOF) to target Redis devices. In replication attacks, actors trick a target into syncing with a malicious server to inject shared object modules for remote code execution.
This agentless capability isn’t restricted to threat hunting. We also have several threat detections rules built for detecting these specific attacks, including: Redis suspicious replication target configured, Redis module loaded from unusual path and Attack Detected and Prevented by Redis
Supply chain attacks, particularly those involving compromised npm packages, have become a critical threat to modern application security. Detecting these subtle, often legitimate-looking installation patterns is essential. We have successfully used Agentless EDR to monitor and identify the exploitation of npm dependencies in real time. For example, our analysis captured installation logs for malicious versions of @asyncapi/specs, highlighting the ability to track package fetching.
By ingesting these logs agentlessly, we can correlate package activity with wider workload behavior, providing visibility into supply chain threats without requiring agents on every node.
Critical Vulnerabilities at Scale: PAN-OS and BeyondTrust
The past year was defined by high-profile RCE vulnerabilities in virtual appliances. In addition to the FortiGate campaigns, we also saw attacks against:
PAN-OS: we observed actors successfully logging into admin accounts via CVE-2026-0257 in the PAN-OS VPN gateway. In another case our research team identified a spike in traffic to the CaptivePortal URI just few days after CVE-2026-0300 disclosure, confirming the exploitation trend.
BeyondTrust Remote Support (CVE-2026-1731): This is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) software with a near-maximum CVSS score of 9.9. We observed successful exploitation of these devices in the wild, specifically targeting unauthenticated administrative command execution.
Case Study: The Zabbix API & Default Credentials
Agentless EDR also provides broad visibility into HTTP and HTTPS endpoints, enabling us to detect unusual activity on a machine and correlate it with Wiz ASM findings or other cloud activity. In one case we investigated this year, the investigation began with the Access To Unusual Executable File With HTTP GET And Query Paramsdetection. This led us to identify a Zabbix instance running from an unusual path with default credentials, which allowed arbitrary code execution on the machine. This type of access is particularly dangerous because Zabbix manages hosts. With administrative permissions, an attacker can create custom triggers that execute arbitrary commands across managed instances, turning a monitoring tool into a powerful lateral movement mechanism.
CopyFail: Exploiting Linux Page Caches
The past few months have seen several Linux LPE vulnerabilities, starting with CopyFail. In this case, Agentless EDR helped identify relevant workload activity that was consistent with successful exploitation using one of the published techniques. Wiz users can view the detection here.
MongoBleed: Addressing Memory-Only Data Exposure
MongoBleed, tracked as CVE-2025-14847, is a critical unauthenticated memory leak vulnerability in MongoDB Server. The vulnerability affects MongoDB’s handling of zlib-compressed network messages, allowing remote attackers to extract sensitive data directly from server memory without valid credentials.
Following its disclosure, MongoBleed was exploited in the wild almost immediately. Agentless visibility helped us identify MongoDB activity associated with real-world exploitation attempts and alert customers in real time.
WordPress: Webshell deployed via wp2shell
Beyond these examples, HTTP access logs provide critical visibility into a wide range of attack vectors. They can help identify threats targeting both the underlying web server and the applications it hosts. For example, access logs from Nginx, Apache, or IIS may reveal exploitation attempts against the server itself, as well as attacks targeting hosted applications and platforms such as WordPress. Using Agentless Workload events, we recently discovered a webshell deployed on a WordPress instance by exploiting the wp2shell vulnerabilities. The malware is a PHP webshell that registers a custom REST API endpoint (/morning/v1/[REDACTED]) with a permissive callback ('__return_true'), allowing attackers to send POST requests containing a base64-encoded command. The plugin decodes and executes this command, returning the output within a JSON response.
Agentless workload detection does more than just uncover blind spots- it provides the precise, deep-level telemetry required for modern defense. With this visibility, you can now build high-fidelity Threat Detection Rules (TDRs) that trigger real-world exploitation patterns. Enable the feature in your settings today to turn raw logs into actionable security intelligence.
Enable Defend Agentless Workload Detection through the Preview Hub.
Virtual appliances are no longer a blind spot. By automatically collecting local logs without deployment overhead, Agentless Workload Detection provides the context needed to trace the full cloud kill chain. From zero-day exploitation in firewalls to misconfigured database APIs, this visibility enables researchers to investigate activity with greater depth and precision.
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.