Agentless Threat Detection: Illuminating Cloud Blind Spots

How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks.

Virtual appliances play a critical role in cloud networks, providing services such as firewalls, secure gateways, and VPN connectivity. Yet, because they operate as "black boxes" that don't support traditional EDR agents, they have historically been a massive visibility gap for security teams. Over the past months,Wiz’s Agentless Workload Detectionhas fundamentally changed this pattern. Not only does it provide critical visibility into virtual appliances, but it also gives our research and IR teams the context needed to investigate activity associated with high-profile threat actors..This allows us to detect and analyze a wide array of sophisticated attacks, all without the need for agents.

In this blog post, we’ll show you a subset of the unique value this new capability has unlocked, across a breadth of threats and targeted technologies.

FortiGate devices are high-value targets because they are often internet-facing and operate as trusted gateways between external and internal networks. Our agentless approach allowed us to track several critical exploitation patterns over the past months:

CVE-2026-24858Exploitation:We observed attackers exploiting this zero-day to create local super-user accounts and modify different settings, enabling lateral movement and greater impact.

Credential Stuffing & FortiBleed:We detected coordinated credential stuffing campaigns leveraging botnets to target exposed admin panels. This aligns with the broaderFortiBleed campaign, which compromised approximately 75,000 devices globally.

Configuration Theft:Attackers were caught downloading full device configurations. Because FortiOS uses reversible encryption for stored credentials, these stolen configs allowed actors to decrypt LDAP service accounts and VPN pre-shared keys to facilitate lateral movement.

While Redis is secure by default when properly configured, exposed or misconfigured deployments are still frequently targeted in cloud environments. Most exploitation attempts remain primarily profit-driven, specifically via cryptojacking. By agentlessly monitoring Redis logs, we have successfully detected real-world attackers abusing these instances in the wild.

We have observed several cases where attackers abuse methods like replication abuse (usingREPLICAOF) to target Redis devices. In replication attacks, actors trick a target into syncing with a malicious server to inject shared object modules for remote code execution.

This agentless capability isn’t restricted to threat hunting. We also have severalthreat detections rulesbuilt for detecting these specific attacks, including:Redis suspicious replication target configured, Redis module loaded from unusual pathandAttack Detected and Prevented by Redis

Supply chain attacks, particularly those involving compromised npm packages, have become a critical threat to modern application security. Detecting these subtle, often legitimate-looking installation patterns is essential. We have successfully used Agentless EDR to monitor and identify the exploitation of npm dependencies in real time. For example, our analysis captured installation logs formalicious versions of @asyncapi/specs, highlighting the ability to track package fetching.

By ingesting these logs agentlessly, we can correlate package activity with wider workload behavior, providing visibility into supply chain threats without requiring agents on every node.

The past year was defined by high-profile RCE vulnerabilities in virtual appliances. In addition to the FortiGate campaigns, we also saw attacks against:

PAN-OS:we observed actors successfully logging into admin accounts viaCVE-2026-0257in the PAN-OS VPN gateway. In another case our research team identified a spike in traffic to the CaptivePortal URI just few days afterCVE-2026-0300disclosure, confirming the exploitation trend.

BeyondTrust Remote Support (CVE-2026-1731):This is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) software with a near-maximum CVSS score of 9.9. We observed successful exploitation of these devices in the wild, specifically targeting unauthenticated administrative command execution.

Agentless EDR also provides broad visibility into HTTP and HTTPS endpoints, enabling us to detect unusual activity on a machine and correlate it withWiz ASMfindings or other cloud activity.In one case we investigated this year, the investigation began with theAccess To Unusual Executable File With HTTP GET And Query Paramsdetection. This led us to identify a Zabbix instance running from an unusual path with default credentials, which allowed arbitrary code execution on the machine. This type of access is particularly dangerous because Zabbix manages hosts. With administrative permissions, an attacker can create custom triggers that execute arbitrary commands across managed instances, turning a monitoring tool into a powerful lateral movement mechanism.

The past few months have seen several Linux LPE vulnerabilities, starting withCopyFail. In this case, Agentless EDR helped identify relevant workload activity that was consistent with successful exploitation using one of the published techniques. Wiz users can view the detectionhere.

MongoBleed, tracked as CVE-2025-14847, is a critical unauthenticated memory leak vulnerability in MongoDB Server. The vulnerability affects MongoDB’s handling of zlib-compressed network messages, allowing remote attackers to extract sensitive data directly from server memory without valid credentials.

Following its disclosure, MongoBleed was exploited in the wild almost immediately. Agentless visibility helped us identify MongoDB activity associated with real-world exploitation attempts andalert customers in real time.

Beyond these examples, HTTP access logs provide critical visibility into a wide range of attack vectors. They can help identify threats targeting both the underlying web server and the applications it hosts. For example, access logs from Nginx, Apache, or IIS may reveal exploitation attempts against the server itself, as well as attacks targeting hosted applications and platforms such as WordPress.Using Agentless Workload events, we recently discovered a webshell deployed on a WordPress instance byexploitingthe wp2shell vulnerabilities.The malware is a PHP webshell that registers a custom REST API endpoint (/morning/v1/[REDACTED]) with a permissive callback ('__return_true'), allowing attackers to send POST requests containing a base64-encoded command. The plugin decodes and executes this command, returning the output within a JSON response.

Agentless workload detection does more than just uncover blind spots- it provides the precise, deep-level telemetry required for modern defense. With this visibility, you can now build high-fidelity Threat Detection Rules (TDRs) that trigger real-world exploitation patterns. Enable the feature in your settings today to turn raw logs into actionable security intelligence.

Enable Defend Agentless Workload Detection through thePreview Hub.

Verify that workload/machine log ingestion is enabled in theEvent Management settings.

To ensure Fortigate logs are collected,make sure Non-OS disk scanning is enabled.

Virtual appliances are no longer a blind spot. By automatically collecting local logs without deployment overhead, Agentless Workload Detection provides the context needed to trace the full cloud kill chain. From zero-day exploitation in firewalls to misconfigured database APIs, this visibility enables researchers to investigate activity with greater depth and precision.

We tap into data from real cloud environments to explore the rapid adoption of AI technologies and how security teams should respond.

As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up.

Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.

Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings