Ransomware Gangs Exploit Multiple VPNs for Network Infiltration
Ransomware operators are increasingly using vulnerabilities in VPN and firewall appliances from major vendors like Palo Alto Networks, Fortinet, Citrix, and Check Point as a primary entry point into corporate networks.
Ransomware gangs are actively exploiting a range of vulnerabilities in widely used VPN and firewall appliances, turning these critical security devices into prime targets for initial network access. Threat actors are leveraging authentication bypass flaws, credential harvesting, and weaknesses in legacy protocols to gain unauthorized entry into corporate networks, often with alarming speed after a vulnerability is disclosed.
The current wave of attacks highlights a concerning trend where internet-facing remote access infrastructure has become the preferred "front door" for ransomware operations. These devices, by their nature, are exposed to the internet and can sometimes run outdated firmware or legacy protocols that organizations are hesitant to disable due to compatibility concerns. This makes them an attractive target for attackers seeking a swift and low-noise path into a target's internal network, bypassing many traditional perimeter security controls.
Several specific campaigns illustrate this threat. The "Fortibleed" campaign has targeted approximately 75,000 internet-facing FortiGate firewalls, focusing on credential compromise through mass harvesting and cracking of stored password hashes. This campaign leverages previously known weaknesses combined with weak or reused passwords on unpatched appliances.
Palo Alto Networks' GlobalProtect VPN is also under attack due to an authentication bypass vulnerability, CVE-2026-0257. Exploitation requires specific configurations, including the use of authentication override cookies and certificate reuse. Threat actors have been observed forging these cookies to gain VPN access without valid credentials or multi-factor authentication, enabling rapid lateral movement.
Check Point VPNs are being targeted via CVE-2026-50751, a flaw tied to the deprecated IKEv1 protocol. This vulnerability allows for authentication bypass, granting attackers access to internal networks. Similarly, Citrix NetScaler appliances are being exploited through a memory disclosure bug, CVE-2026-8451, reminiscent of the "CitrixBleed" vulnerability, which allows attackers to steal sensitive information.
The speed at which these vulnerabilities are weaponized is a significant concern. Proof-of-concept code for the Palo Alto flaw was released shortly before active exploitation began, and attacks against the Citrix NetScaler vulnerability commenced within 24 hours of its disclosure. This compressed timeline leaves defenders with minimal time to patch and mitigate risks before their networks are compromised.
Once inside, attackers are moving rapidly to exfiltrate data and deploy ransomware, often within days of gaining initial access. This coordinated exploitation across multiple vendors underscores the critical need for organizations to prioritize patching and securing their remote access infrastructure, as these devices represent a high-value target for ransomware operators seeking to disrupt operations and extort victims.