Loading story…
A research paper from the Blekinge Institute of Technology in Sweden documented a 238% increase in attacks targeting virtual private networks (VPNs) between 2020 and 2022, coinciding with the rapid expansion of remote work during the COVID-19 pandemic. The study, which analyzed 81 reports from sources such as Google and BrightTALK, found that organizations rushed to deploy VPNs to support a growing remote workforce, often without adequate security controls or preparation. This led to widespread vulnerabilities, including exposed gateways, misconfigurations, and unpatched systems, which threat actors exploited to gain unauthorized access and move laterally within corporate networks.
Researchers concluded that many new VPN users lacked essential endpoint controls and network segmentation, making it easier for attackers to compromise entire environments. Security experts noted that while VPNs are not inherently difficult to secure, the unprecedented pace of adoption and lack of experience among organizations significantly increased the attack surface. The findings highlight the critical need for robust VPN security practices, especially in environments with rapidly changing remote access requirements.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
Recent incidents involving SonicWall SSL VPN and Ivanti Connect Secure showed that VPNs remained a significant security risk even after the post-pandemic decline in attack volume. These cases were cited as evidence that VPN-related exposure continues to be exploited.
In 2025, researchers from the Blekinge Institute of Technology published findings highlighting how insecure VPN deployments created lasting attack surface risk. The study recommended hardening measures including strong authentication, robust encryption, secure configuration, and continuous monitoring.
A 2025 study by the Blekinge Institute of Technology found that attacks targeting VPNs increased by 238% from 2020 to 2022. The rise was linked to exposed gateways, misconfigurations, unpatched vulnerabilities, and weak network segmentation in many environments.
During the COVID-19 pandemic, organizations rapidly deployed VPNs to support large-scale remote work. Many deployments, especially in small and mid-sized businesses, were implemented without sufficient expertise or ongoing security management.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026
Organizations using on-premises VPN devices, particularly from vendors such as Citrix, Cisco, SonicWall, Palo Alto, and Fortinet, face a significantly higher risk of ransomware attacks compared to those using cloud-based VPNs or no VPNs at all. According to At-Bay’s 2025 InsurSec Report, 83% of ransomware incidents involved VPNs, and 80% began with a remote access compromise, with a notable 300% increase in Akira ransomware attacks targeting SonicWall devices in Q3 2025, often exploiting vulnerabilities like CVE-2024-40766. The complexity and maintenance requirements of on-premises VPNs, combined with outdated configurations and missed patches, contribute to this elevated risk, prompting security leaders to recommend transitioning to modern cloud-based remote access solutions. Cyber insurance data further highlights that 90% of claims stem from email and VPN-related incidents, with larger organizations being disproportionately targeted. Email remains the top entry vector, accounting for 43% of all incidents in 2024, and the frequency of such claims continues to rise. Attackers are leveraging both traditional and advanced techniques, including generative AI, to bypass defenses, resulting in substantial financial losses. The convergence of these trends underscores the urgent need for organizations to reassess their remote access infrastructure and email security posture to mitigate the risk of ransomware and other cyber threats.
Jun 29, 2026
Threat actors launched a large-scale, automated credential-stuffing campaign targeting enterprise VPN authentication infrastructure, specifically focusing on Palo Alto Networks GlobalProtect and Cisco SSL VPN gateways. The campaign, observed in mid-December 2025, involved millions of scripted login attempts over a short period, with attackers pivoting rapidly between the two vendors. GreyNoise intelligence identified that the attacks originated almost exclusively from centralized infrastructure hosted by Germany’s 3xK GmbH, utilizing uniform request patterns, common username-password combinations, and atypical browser user agents to probe for weak or exposed VPN portals. Over 1.7 million login attempts were recorded against GlobalProtect portals in just 16 hours, with more than 10,000 unique IPs participating, primarily geolocated to the United States, Pakistan, and Mexico. Following the surge against Palo Alto, the attackers shifted focus to Cisco SSL VPNs, where a significant spike in unique attacking IPs was observed, rising from under 200 to 1,273 in a single day. The campaign did not exploit any zero-day vulnerabilities but relied on credential stuffing and password spraying techniques, indicating the use of potentially massive stolen credential lists. The uniformity in attack infrastructure, timing, and technical indicators across both VPN platforms underscores the persistent risk to remote access systems and highlights the need for robust authentication and monitoring of enterprise VPN endpoints.
Jun 29, 2026