Network Boundary Bridging

Adversaries may bridge trusted and untrusted network segments by compromising a perimeter network device or an internal device responsible for network segmentation, then changing its traffic policy so traffic otherwise prohibited can cross the boundary. Kaspersky's 2021 investigation of a 2020 Lazarus intrusion reports that the group compromised a CentOS router VM between corporate and restricted segments, accessed its Webmin interface with privileged root credentials, and configured Apache as an inter-segment proxy; the report does not publish the complete configuration commands. The retained PortBender steps show host-level redirection for an SMB-relay example; they do not reproduce that network-device procedure.