Loading story…
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from Palo Alto Networks, Fortinet, Check Point, and Citrix, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included FortiBleed credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass CVE-2026-0257, abuse of Check Point VPN authentication bypass CVE-2026-50751, and rapid exploitation of Citrix NetScaler memory-disclosure flaw CVE-2026-8451. Security reporting linked Qilin affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release.
After gaining access, attackers were reported using lateral movement and credential-theft techniques including Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, Chrome credential theft via GPO, and WSL-based EDR evasion, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. Ron Wyden to call for a federal purge of legacy, public-facing VPNs, urging OMB, CISA, and NIST to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A coordinated mid-2026 wave of ransomware initial-access activity targeted internet-facing VPN and firewall appliances from Fortinet, Palo Alto Networks, Check Point, and Citrix. Victims were reported across the United States, United Kingdom, Australia, and Western Europe in sectors including healthcare, education, manufacturing, government, media, professional services, and critical infrastructure.
Attackers rapidly began exploiting the Citrix NetScaler memory-disclosure flaw CVE-2026-8451, with reporting emphasizing very short weaponization timelines after disclosure or proof-of-concept release. The flaw was one of four campaigns highlighted in the mid-2026 ransomware access surge.
Qilin-linked ransomware affiliates exploited the Check Point VPN authentication bypass vulnerability CVE-2026-50751 as part of edge-device intrusion activity. The access was used for follow-on actions such as lateral movement, credential theft, exfiltration, and eventual double-extortion deployment.
Ransomware operators exploited the Palo Alto Networks GlobalProtect authentication bypass flaw CVE-2026-0257 to gain initial access through internet-facing VPN infrastructure. Reporting linked Qilin affiliates to at least some of the post-compromise activity following this access.
A ransomware-linked campaign dubbed FortiBleed targeted Fortinet FortiGate gateways by exposing credentials from internet-facing appliances. The activity was cited as part of a broader mid-2026 surge in attacks against legacy VPN and firewall infrastructure.
Sen. Ron Wyden called on OMB, CISA, and NIST to lead a government-wide effort to eliminate older internet-facing VPN and remote-access systems from federal agencies. He cited ArcaneDoor, FortiBleed, and exploited Ivanti and Check Point VPN flaws as evidence and asked for a binding directive, implementation standards, and funding priorities aligned to zero-trust adoption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. health-sector authorities warned hospitals and clinics to urgently patch a **critical vulnerability** in *BeyondTrust Remote Support* and *Privileged Remote Access* that can provide attackers an initial foothold and enable **unauthorized control** of affected appliances inside enterprise networks. The flaw is tracked as **CVE-2026-1731** and was highlighted to the healthcare and public health sector amid increased targeting of those organizations. **CISA** added CVE-2026-1731 to its **Known Exploited Vulnerabilities (KEV)** catalog and set an accelerated remediation deadline for federal agencies, later updating the entry to warn that **ransomware operators are actively exploiting** the issue. *Palo Alto Networks Unit 42* also reported observed in-the-wild exploitation, describing threat actors weaponizing the vulnerability to take control of appliances and expand access within victim environments, increasing risk to clinical networks if unpatched.
Jul 12, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Check Point disclosed active exploitation of **CVE-2026-50751**, a critical authentication bypass in Check Point VPN Remote Access, Mobile Access, and Spark firewalls under specific configurations. The flaw, rated **CVSS 9.3**, affects systems using the deprecated **IKEv1** key exchange path and allows a remote, unauthenticated attacker to establish a VPN session without a valid password. Check Point said suspicious activity was detected on June 4, with the earliest known attacks dating to early May and a rise in activity across multiple jurisdictions in early June; customers were urged to review logs back to May 7 and investigate indicators of compromise. The company linked at least one confirmed post-compromise intrusion to a **Qilin ransomware** affiliate, describing a financially motivated attack that used VPS infrastructure and likely relied on **Rclone** for data exfiltration, with possible use of the **Tox** protocol for communications. Reporting also noted attempts to retrieve malicious **ELF** payloads from attacker-controlled infrastructure and warned that related infrastructure may also be probing VPN flaws in products from **Palo Alto, Fortinet, and F5**. Check Point released hotfixes for CVE-2026-50751 and for **CVE-2026-50752**, a separate flaw that could enable man-in-the-middle attacks on site-to-site tunnels but had not been observed as weaponized; the vendor advised organizations to apply fixes or disable IKEv1 where possible.
Jul 23, 2026