Loading story…
Organizations using on-premises VPN devices, particularly from vendors such as Citrix, Cisco, SonicWall, Palo Alto, and Fortinet, face a significantly higher risk of ransomware attacks compared to those using cloud-based VPNs or no VPNs at all. According to At-Bay’s 2025 InsurSec Report, 83% of ransomware incidents involved VPNs, and 80% began with a remote access compromise, with a notable 300% increase in Akira ransomware attacks targeting SonicWall devices in Q3 2025, often exploiting vulnerabilities like CVE-2024-40766. The complexity and maintenance requirements of on-premises VPNs, combined with outdated configurations and missed patches, contribute to this elevated risk, prompting security leaders to recommend transitioning to modern cloud-based remote access solutions.
Cyber insurance data further highlights that 90% of claims stem from email and VPN-related incidents, with larger organizations being disproportionately targeted. Email remains the top entry vector, accounting for 43% of all incidents in 2024, and the frequency of such claims continues to rise. Attackers are leveraging both traditional and advanced techniques, including generative AI, to bypass defenses, resulting in substantial financial losses. The convergence of these trends underscores the urgent need for organizations to reassess their remote access infrastructure and email security posture to mitigate the risk of ransomware and other cyber threats.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The same report said Citrix and Cisco VPN products were most strongly associated with ransomware victimization, followed by SonicWall, Palo Alto Global Protect, and Fortinet. The analysis was published as part of broader reporting on cyber claims tied to email and remote access exposures.
A report found that 80% of ransomware incidents began with a remote access compromise and that 83% involved VPNs, highlighting remote access infrastructure as a major initial access vector. The findings also associated on-premises VPN devices and routers with significantly higher ransomware risk than cloud-based VPNs or no VPN use.
The report noted a 300% increase in Akira ransomware attacks targeting SonicWall devices during Q3 2025. The activity was linked to exploitation of CVE-2024-40766.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware continues to be the predominant cause of high-value cyber insurance claims in 2025, with attackers increasingly targeting small and mid-sized businesses as large enterprises bolster their defenses. According to Allianz’s Cyber Security Resilience 2025 report, 88% of breaches at smaller firms involved ransomware, compared to 39% at larger organizations, highlighting a shift in attacker focus toward easier targets. Ransomware accounted for approximately 60% of insurance claims exceeding €1 million in the first half of 2025, underscoring its financial impact. Attackers are evolving their tactics, moving beyond simple encryption to prioritize data exfiltration, which is often less resource-intensive and more likely to result in ransom payments. The value of stolen data is rising, and the average global breach cost is approaching $5 million, with privacy regulations and litigation risks compounding the financial exposure for affected organizations. Social engineering, phishing, and business email compromise remain prevalent, with generative AI making these attacks more convincing and credential abuse now the most common attack vector. Groups such as Scattered Spider exemplify the trend of using social engineering and credential theft to rapidly escalate attacks from account takeover to ransomware deployment. Retailers have become the most targeted sector in early 2025, following manufacturing and professional services in total losses, due to their large volumes of personal data and complex supply chains. Supply chain disruptions are also emerging as a significant source of cyber insurance claims, as interconnected business operations increase systemic risk. The evolving threat landscape is prompting organizations to reassess their cyber resilience strategies, with a focus on proactive defense measures and third-party risk management. The increasing sophistication of attacks, especially those leveraging AI and targeting operational technology, is driving a need for improved governance and contractual protections with suppliers. As attackers adapt, organizations must prioritize both IT and OT security, ensure executive support for resilience initiatives, and address hidden dependencies that could become blind spots in their defenses. The convergence of ransomware, data exfiltration, and supply chain vulnerabilities is shaping the cyber insurance market and influencing security priorities for businesses of all sizes in 2025.
Jun 29, 2026
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026
A research paper from the Blekinge Institute of Technology in Sweden documented a 238% increase in attacks targeting virtual private networks (VPNs) between 2020 and 2022, coinciding with the rapid expansion of remote work during the COVID-19 pandemic. The study, which analyzed 81 reports from sources such as Google and BrightTALK, found that organizations rushed to deploy VPNs to support a growing remote workforce, often without adequate security controls or preparation. This led to widespread vulnerabilities, including exposed gateways, misconfigurations, and unpatched systems, which threat actors exploited to gain unauthorized access and move laterally within corporate networks. Researchers concluded that many new VPN users lacked essential endpoint controls and network segmentation, making it easier for attackers to compromise entire environments. Security experts noted that while VPNs are not inherently difficult to secure, the unprecedented pace of adoption and lack of experience among organizations significantly increased the attack surface. The findings highlight the critical need for robust VPN security practices, especially in environments with rapidly changing remote access requirements.
Jun 29, 2026