Private cellular connectivity
against automated attacks using AI

IDY Co., Ltd. | 10 November 2026

Abstract

The National Police Agency's ransomware surveys identify internet-exposed VPN appliances as the most frequently reported infection route among valid responses in both 2025 and the first half of 2026 [1][2]. Disclosures of data leaks in Japan have increased sharply since September 2026, and public bodies have pointed to the possible use of AI in target research and compromise [4][5][8]. This report examines how internet-facing listening endpoints become starting points for discovery and compromise, and proposes a private cellular architecture that replaces VPN access with a carrier's private 5G network to separate inter-site traffic from the internet. The architecture addresses three requirements—hidden, inaccessible and resilient—without wired access-line construction and with redundancy using private-network SIMs from multiple carriers.

1. Introduction

Internet VPNs have been widely used for inter-site communications and maintenance access. Because VPN appliances listen for connections on the internet, their presence makes them targets for discovery. As attacks become increasingly automated, reducing these internet-visible entry points is an important challenge.

Section 2 reviews statistics and public advisories. Section 3 examines attack sequences, contributing factors and countermeasure requirements. Section 4 presents the proposed architecture, Section 5 discusses redundancy, Section 6 examines deployment, and Section 7 defines the scope and limitations.

2. Background

2.1 Ransomware infection routes

According to the National Police Agency, 123 ransomware incidents were reported to police in the first half of 2026, the highest half-year total [1]. Of 36 valid responses on infection routes, 18 (50.0%) cited VPN appliances and nine (25.0%) cited remote desktop access. In 2025, VPN appliances accounted for 61 of 92 valid responses (66.3%) [2], making them the most frequently reported route in both periods (Figure 1).

2.2 Automated attacks using AI and increasing data leaks

Disclosures of data leaks in Japan have increased sharply since September 2026. According to MM Research Institute, cyberattacks disclosed through the end of October 2026 involved approximately 376 million leaked or potentially leaked records, about 7.6 times the 49.53 million records in all of 2025. October alone accounted for approximately 185 million records. The January–October totals of 661 incidents and 45 major incidents involving at least one million records were both the highest in the past five years [9] (Figure 2).

The Personal Information Protection Commission [3], JPCERT/CC [4], the National Cybersecurity Office [6] and the Ministry of Internal Affairs and Communications [7] subsequently issued advisories. In its investigation of infrastructure potentially used in attacks, JPCERT/CC confirmed that attackers had used AI for activities including scanning for known vulnerabilities [5]. The National Cybersecurity Office also stated that attackers were highly likely to be using AI for target research and compromise [8]. AI can enable discovery of internet-reachable devices at a scale and speed difficult to achieve manually.

3. Problems and contributing factors

3.1 A typical attack sequence

Attacks through VPN appliances generally follow the sequence in Figure 3. Attackers scan for public VPN appliances and identify their models, then exploit vulnerabilities or use stolen credentials to sign in as legitimate users. They subsequently conduct internal reconnaissance and lateral movement, ultimately stealing data and encrypting systems with ransomware.

These incidents have encouraged replacement of internet-exposed VPN appliances with other connectivity methods.

3.2 Main factors enabling attacks

The attacks described above are enabled by three main factors.

3.3 Countermeasure requirements

Based on these factors, this report defines three requirements.

(a) Hidden: No internet-facing listening endpoint should be present for internet-based discovery.

(b) Inaccessible: Only devices with SIMs registered with the carrier should be able to access the network; credentials alone should not establish connectivity.

(c) Resilient: Redundancy should address carrier outages and congestion so that moving to a private network does not compromise business continuity.

4. Proposed architecture

4.1 Wired and cellular private networks

Wired private networks, including IP-VPN and leased lines, also separate communications from the internet. However, connecting numerous distributed sites requires access-line construction, cost and lead time at each site. Cellular private networks using SIMs provisioned for a carrier's private service can be activated without access-line construction (Table 1).

*1 Installation and configuration time assumes that the private-network service contract and SIMs are already in place.

Wired private networks remain a strong option for large fixed sites with continuous high-volume traffic. A combination of wired and cellular networks may be appropriate to the scale and purpose of each site.

4.2 IDY's recommended private cellular architecture

The proposed architecture connects sites to a central location, such as headquarters or a data center, through IDY 5G edge gateways including iR800B and iR730B and a carrier's private 5G network. No internet breakout is provided; inter-site communications remain within the private network (Figure 4).

The architecture addresses the requirements in Section 3.3 as follows.

(a) Hidden: There is no VPN appliance listening through a public IP address, so internet scanning cannot discover that entry point.

(b) Inaccessible: Only devices with carrier-registered SIMs can access the private network. Contractor access can also be restricted or suspended per SIM.

(c) Resilient: Every site uses private-network SIMs from two carriers for cross-carrier redundancy (Section 5).

Where no other internet connection is provided, even a compromised device at a site has no route to communicate with an external command server or exfiltrate data over the internet. Table 2 compares the architecture with internet VPN access.

4.3 Architecture requirements and iR800B suitability

To maintain operations after replacing VPN access with private cellular connectivity, site equipment must provide appropriate 5G performance, wired interfaces suitable for the site's core network, and redundancy. Table 3 relates these requirements to iR800B capabilities.

*2 IDY measurements using iR800B-102 [10] and Anritsu MT8000A (5G SA n79, 2CC CA, 200MHz total bandwidth, 4×4 MIMO). iperf3 ran on a LAN-side PC connected over 10GbE using the standard internal USB connection. The PCIe configuration achieved 2.34Gbps, and iperf3 running inside the device achieved 2.45Gbps.

5. Redundancy

Carrier outages and congestion are key concerns when adopting cellular private networks. IDY offers three levels of redundancy according to site criticality (Figure 5) [11].

The highest configuration connects a 5G USB modem, iS201B, to iR800B over USB 3.2. Three SIMs support two communications paths simultaneously (2 Active). With iR800B-107, all three lines remain registered with base stations: two Active and one Standby. Keeping the standby line registered reduces the processing required before switching compared with configurations requiring registration. iR800B-102 also supports two simultaneous paths with iS201B, but switching to its internal standby SIM requires base-station registration and therefore takes longer.

The relevant criteria are the number of registered lines, simultaneous communications paths and available failover routes, rather than SIM count alone. IDY designs link monitoring, fault detection, route selection, post-switch connectivity checks and recovery assessment as a coordinated communications-control process. All models also attempt staged recovery after a communications interruption: reconnection, radio soft reset, hardware reset and device restart.

*3 Switching time depends on registration state, carrier, detection criteria and routing configuration. Bandwidth aggregation and uninterrupted switching require application-specific system design and control.

6. Deployment

Vulnerability remediation and system redevelopment commonly take months, while scanning continues. Private cellular connectivity can be introduced without modifying existing applications. When the private-network service contract and SIMs are ready, equipment installation and configuration may be completed in a few hours (*1, Figure 6). The architecture can therefore also reduce exposed entry points while fundamental remediation is being completed.

7. Scope and limitations

This architecture addresses non-public communications, such as inter-site and maintenance access previously carried over an internet VPN. Public websites and services require internet reachability and are outside its scope. They require complementary measures such as WAF, vulnerability assessment and prompt patching.

Even within a private network, compromised authorized devices can enable intrusion. Internal device management and updates remain necessary. If a site or central location has other internet connections, those routes also require management and monitoring.

8. Conclusion

This report examined how internet-facing VPN appliances become starting points for discovery and compromise, and proposed moving inter-site communications to a private 5G network. The architecture addresses three requirements: removing listening endpoints (hidden), SIM-based connection control (inaccessible) and redundancy across carriers (resilient). It can be deployed without wired access-line construction. Selecting among iR800B with iS201B, standalone iR800B and iR730B according to site criticality supports both security and business continuity.

References

Company and product names are trademarks or registered trademarks of their respective owners.

Appendix. Product specifications

A.1 iR800B 5G edge gateway

An industrial 5G edge gateway supporting 10GbE that serves as the site-side core of the proposed architecture.

A.2 iS201B 5G USB modem

A USB-powered 5G modem that adds an independent communications path using a third SIM when connected to iR800B over USB 3.2.

Measured iS201B downlink throughput was 3,060Mbps on Windows and 3,030Mbps on Ubuntu. Measurements were made in IDY’s evaluation environment with iS201B connected to a PC running iperf3 (2CC CA, 200MHz, 4×4 MIMO). Actual throughput varies with network, radio conditions, OS and test configuration.

A.3 iR730B 5G edge gateway

An industrial 5G/LTE edge gateway inheriting the compact, rugged design and industrial I/O of the iR700B family. Its fanless, compact enclosure suits distributed small sites.