A subnet router, or exit node, on a mesh VPN advertises routes to a private network so other nodes can reach hosts behind it. An attacker who controls or enrolls such a node abuses it as an egress relay, routing their traffic through the internal network to reach services and move data while appearing to be internal traffic. Defend by restricting who can advertise and use routes, approving advertised routes, and monitoring relay traffic.
What subnet router abuse is
Mesh VPNs let a node act as a subnet router or exit node, advertising routes so remote nodes can reach a private network segment or send traffic out through it. That capability is convenient for admins and equally useful to an attacker who lands on or enrolls such a node, because it turns one host into a gateway into the internal network.
How it works and example
With control of a subnet router or exit node, the attacker routes their traffic through it to reach internal services that are not directly exposed, and uses it as an egress relay so outbound activity looks like normal internal traffic. Combined with a stolen mesh key, this lets an intruder pivot broadly and exfiltrate through a trusted path, as observed in a recent mesh-VPN intrusion.
How to defend against it
Restrict which nodes may advertise routes and which may use them through ACLs, and require explicit approval of advertised subnet routes rather than auto-accepting them. Segment the internal network so a single relay reaches little, monitor traffic volumes and destinations through routers and exit nodes, and alert on new or unexpected route advertisements.
References
- [1]MITRE ATT&CK: Lateral Movement (TA0008)(MITRE ATT&CK)
- [2]HuggingFace, Agent intrusion technical timeline(HuggingFace)
A single relay node can open your whole internal network. Talk to a security expert about how routes are advertised and approved on your mesh.