APT41G0096 ↗
Used NATBypass to bypass firewall restrictions and to access compromised systems via RDP.1
tfMITRE ATT&CK technique
Network Boundary Bridging T1599
- Tactic
- Defense Impairment
- Platform
- Network Devices
- Version
- 2.0
- Created
- 19 October 2020
- Last modified
- 12 May 2026
Sub-techniques 12 rules across the family · 1 mapped directly to T1599 · 1 of 1 carry rules
Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Network Boundary Bridging MITRE reference T1599
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Indian Critical Infrastructure IntrusionsC0043 ↗
Involved the use of FRP to bridge network boundaries and overcome NAT.1 Indian Critical Infrastructure Intrusions also involved the use of VPN tunnels with a potentially compromised MSP entity allowing for direct access to critical infrastructure entity networks.2
All 1 campaigns for this technique
Offense vs defense T1599
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2026 Q3 · 0 of 1 campaigns plotted (Indian Critical Infrastructure Intrusions (dated 2021) falls before the 2023 window)Network Boundary Bridging detection strategy DET0006
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Network Boundary Bridging
1 platform
AN0015 · Network Devices
From a defender’s perspective, suspicious bridging is observed when network devices begin allowing traffic that contradicts existing segmentation or access policies. Observable behaviors include sudden modifications to ACLs or firewall rules, unusual cross-boundary traffic flows (e.g., east-west communications across separated VLANs), or simultaneous ingress/egress anomalies. Multi-event correlation is key: configuration changes on a router/firewall followed by unexpected traffic patterns, especially from unusual sources, is a strong indicator of compromise.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | NSM:Flow | Unexpected flows between segmented networks or prohibited ports |
| Network Traffic ContentDC0085 | networkdevice:syslog | ACL/Firewall rule modification or new route injection |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window between configuration changes and abnormal traffic; tuned to match expected administrative change cycles. |
| ApprovedChangeList | Known authorized ACL/firewall changes; suppresses noise from legitimate maintenance. |
| GeoLocation | Geographic origin of new traffic patterns; helps distinguish benign remote offices from suspicious foreign access. |
| TrafficVolumeThreshold | Volume of cross-segment traffic; tuned to detect large-scale lateral flows without flagging small test connections. |
Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats. Ensure that, where available, local passwords are always encrypted, per vendor recommendations.
Upon identifying a compromised network device being used to bridge a network boundary, block the malicious packets using an unaffected network device in path, such as a firewall or a router that has not been compromised. Continue to monitor for additional activity and to ensure that the blocks are indeed effective.
Use multi-factor authentication for user and privileged accounts. Most embedded network devices support TACACS+ and/or RADIUS. Follow vendor prescribed best practices for hardening access control.
Password PoliciesM1027
Refer to NIST guidelines when creating password policies.
Restrict administrator accounts to as few individuals as possible, following least privilege principles. Prevent credential overlap across systems of administrator and privileged accounts, particularly between network and non-network platforms, such as servers or endpoints.