An increase in espionage attacks has led researchers to observe a notable shift in Chinese and Russian hackers’ tactical shift towards targeting edge devices like VPN appliances, firewalls, routers, and Internet of Things (IoT) tools. Previously, it has been common to see hackers targeting employees with malicious phishing emails to gain access to companies, but last year saw one of the lowest recent volumes of espionage attacks on Windows computers, but instead a trend towards zero-day vulnerabilities and malware developed for edge devices. Researchers believe that the current nature of Endpoint Detection and Response (EDR) solutions have reached a level of effectiveness where threat actors would have better odds of avoiding detection by deploying malware on a VPN appliance, for example, as opposed to a Windows computer. This belief is backed by the fact that there was a 50% growth in zero-days used by both espionage groups and financially motivated attackers last year, compared to 2022. Exploiting zero-day vulnerabilities in commonly deployed devices likely allows hackers to remain undetected within systems for longer periods of time as opposed to more traditional targets like Windows computers with robust EDR solutions, reflecting the trend of stealth and longevity within compromised systems, an emphasis of espionage hacking. Although the exploitation of edge vulnerabilities has become a favored approach for both espionage and criminal activities as a means of staying within a system for longer without being flagged by security solutions, the average “dwell time” in breached systems has also decreased to a record low of roughly ten (10) days, indicating improved detection capabilities and enhanced defense mechanisms against sophisticated threats. CTIX analysts recommend organizations implement monitoring and detection capabilities to better defend against cyberattacks.