A lot of home, small business, or neglected enterprise routers and firewalls are broken into permanently. Many of these will not auto-update their firmware or t

A lot of home, small business, or neglected enterprise routers and firewalls are broken into permanently. Many of these will not auto-update their firmware or the attackers got in before the patch was available. Then the initial actor sells access to them to other actors. I believe the Ubiquity Edge router, a small/medium/AV industry favorite, was paired with other exploits by a state actor to perform attacks on high value orgs.