Ransomware Gangs Attack Palo Alto, Fortinet, Citrix, and Check Point VPNs to Target Corporate Networks

A coordinated wave of exploitation targeting edge VPN and firewall appliances from four major vendors Palo Alto Networks, Fortinet, Citrix, and Check Point has emerged as the dominant initial-access vector for ransomware operators in mid-2026.

Threat actors, including affiliates of the Qilin ransomware-as-a-service (RaaS) operation, are chaining authentication-bypass flaws, credential-harvesting campaigns, and legacy-protocol weaknesses to obtain unauthenticated or credential-free access to corporate perimeters.

Once inside, these actors move rapidly toward lateral movement, data exfiltration, and double-extortion ransomware deployment, often within days of a CVE’s public disclosure.

The campaigns analyzed here span four separate but converging incidents: the “Fortibleed” mass credential-compromise campaign against roughly 75,000 internet-facing FortiGate firewalls; active exploitation of the Palo Alto GlobalProtect authentication-bypass flaw CVE-2026-0257; Qilin-linked exploitation of the Check Point VPN authentication-bypass flaw CVE-2026-50751 tied to the deprecated IKEv1 protocol; and rapid in-the-wild abuse of a new CitrixBleed-style NetScaler memory-disclosure bug, CVE-2026-8451.

Each incident underscores the same operational reality: internet-facing remote access infrastructure has become the ransomware ecosystem’s preferred front door.

Why VPN Gateways Have Become the Preferred Entry Point

Enterprise VPN and firewall appliances sit at the network edge, are internet-reachable by design, and frequently run outdated firmware or legacy protocols that organizations are reluctant to disable due to compatibility concerns.

This combination makes them attractive to ransomware affiliates who prize a fast, low-noise route into a target’s internal network without triggering endpoint detection tools.

Successful authentication bypass or credential theft against a VPN concentrator lets an attacker walk in as a “legitimate” remote user, sidestepping most perimeter-focused security controls entirely.

The speed of weaponization has also compressed dramatically. Attackers exploited the Palo Alto GlobalProtect flaw within days of public proof-of-concept code being released, and exploitation attempts against the Citrix NetScaler flaw began less than 24 hours after Citrix’s July 2026 disclosure. This near-immediate exploitation window leaves defenders very little time between patch release and active abuse.

Campaign 1: Fortibleed Mass FortiGate Credential Compromise

Fortibleed is a large-scale credential-harvesting campaign, first identified in mid-June 2026, in which threat actors systematically extracted configuration files from internet-facing Fortinet FortiGate firewalls and cracked the stored password hashes.

Independent analysis by Kevin Beaumont, Hudson Rock, and SOCRadar found working administrator and SSL VPN credentials for between roughly 30,791 and 75,000 devices spanning 194 countries and more than 21,000 domains, approximately half of all internet-facing FortiGate appliances visible on Shodan.

Unlike a single-CVE exploit chain, Fortibleed reflects the cumulative effect of previously known FortiOS credential-storage weaknesses combined with weak or reused passwords and unpatched appliances left exposed to the internet.

Researchers warn that any organization appearing in the exposed dataset should treat its network perimeter as already compromised.

Takeaway for Defenders:

• Rotate every FortiGate administrator and SSL VPN password immediately, particularly for internet-facing devices
• Upgrade to a supported FortiOS release, then require every administrator to log in once post-upgrade to force PBKDF2 password re-hashing
• Remove management interfaces (ports 443/10443) from direct internet exposure
• Enforce MFA on all administrative and remote-access accounts
• Hunt for unexpected admin logins, unknown accounts, and unauthorized configuration changes

Campaign 2: Palo Alto GlobalProtect Authentication Bypass (CVE-2026-0257)

Palo Alto Networks disclosed CVE-2026-0257 on May 13, 2026, describing an authentication-bypass vulnerability (CWE-565) in the GlobalProtect portal and gateway components of PAN-OS.

The flaw stems from PAN-OS trusting any authentication override cookie it can decrypt without verifying the cookie was legitimately generated by the device; if the same certificate is reused for the GlobalProtect HTTPS service and cookie encryption, an attacker can retrieve the certificate chain from the public HTTPS service and forge valid cookies for any user, including administrators.

Exploitation requires three conditions: GlobalProtect portal or gateway enabled, authentication override cookies enabled (not default), and certificate reuse or exposure.

Rapid7 published a working proof-of-concept on May 29, 2026, prompting Palo Alto to raise the CVSS score from an initial 4.7 to 7.8, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day.

Active exploitation has been confirmed as far back as May 17, 2026. By July 2026, Qilin ransomware affiliates were confirmed abusing this flaw to gain unauthorized VPN access to unpatched networks.

In observed intrusions, threat actors forged authentication override cookies for privileged accounts, including default “admin” accounts, to establish VPN sessions without credentials or MFA, then used post-exploitation tools such as Impacket and NTLM relay attacks for configuration retrieval, IPsec tunnel establishment, and lateral movement.

Affected products: PA-Series and VM-Series firewalls and Prisma Access running PAN-OS with GlobalProtect enabled and authentication override cookies configured. Cloud NGFW is not affected.

Remediation:

• Upgrade to fixed PAN-OS releases (≥12.1.4-h6/12.1.7, ≥11.2.4-h17, ≥11.1.4-h33, ≥10.2.7-h34, or later per the vendor advisory)
• If patching is not immediately possible, disable authentication override cookies or generate a dedicated certificate used exclusively for that feature
• Restrict GlobalProtect exposure to trusted IP ranges and enforce MFA for all administrative accounts

Check Point VPN IKEv1 Authentication Bypass (CVE-2026-50751)

Check Point disclosed CVE-2026-50751 (CVSS 9.3) on June 8, 2026, warning of active exploitation of a logic-flow weakness in certificate validation affecting Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key-exchange protocol.

The flaw allows an unauthenticated remote attacker to bypass user authentication and establish a VPN session without a valid password.

Exploitation requires several conditions to align: VPN Remote Access or Mobile Access enabled, IKEv1 enabled for remote access, gateways accepting legacy Remote Access clients, and no machine-certificate requirement. Check Point confirmed that attacks against the flaw began as early as May 7, 2026, a full month before public disclosure, and picked up pace in early June.

Critically, Check Point confirmed that a Qilin ransomware affiliate exploited the vulnerability in post-compromise activity against victim organizations. WatchTowr Labs later detailed how attackers manipulated authentication flags via a custom VPNExtFeatures Vendor ID payload during IKEv1 negotiation to achieve full authentication bypass.

A related flaw, CVE-2026-50752 (CVSS 7.4), affects certificate validation in IKEv1 and could enable adversary-in-the-middle attacks against site-to-site VPN connections, though no in-the-wild exploitation of this second bug has been confirmed.

Affected products: Security Gateways R82.10 JHF Take 19 or below, R82 JHF Take 103 or below, R81.20 JHF Take 141 or below, R81.10/R81/R80.40 (all end-of-support), and Spark Firewalls R80.20.X/R81.10.X/R82.00.X.

Remediation:

• Apply the Check Point hotfixes addressing CVE-2026-50751 and CVE-2026-50752 on all affected Security Gateways and Spark appliances immediately
• Disable IKEv1 for remote access wherever legacy client support is not strictly required
• Require machine certificates for VPN client connections
• Review logs for VPN sessions established without full password authentication

Campaign 4: Citrix NetScaler CitrixBleed-Style Memory Disclosure (CVE-2026-8451)

Citrix disclosed six vulnerabilities in NetScaler ADC and NetScaler Gateway on June 30, 2026, the most urgent being CVE-2026-8451 (CVSS 8.8), a pre-authentication out-of-bounds read in NetScaler’s XML/SAML parser that can leak fragments of appliance memory via the NSC_TASS cookie when a device is configured as a SAML Identity Provider.

Researchers classified it in the same “CitrixBleed” vulnerability family as the original CVE-2023-4966, CitrixBleed 2 (CVE-2025-5777), and CitrixBleed 3 (CVE-2026-3055), all of which were weaponized by ransomware actors following disclosure.

Exploitation attempts began less than 24 hours after disclosure. Security firm Lupovis observed threat actors probing exposed NetScaler systems with malformed <samlp:AuthnRequest> payloads padded with hundreds of spaces, a pattern matching watchTowr’s published detection artifact, with one campaign traced to IP 146.70.139[.]154.

Unlike earlier CitrixBleed variants that leaked kilobytes of memory including session tokens, CVE-2026-8451 leaks only small memory fragments per request and has not been confirmed to expose credentials or session IDs directly, though repeated requests could still expose process memory pointers useful for follow-on exploitation.

This flaw follows closely on the heels of CVE-2026-3055 (CVSS 9.3), a related NetScaler memory-overread bug patched in March 2026 that saw active reconnaissance within days and confirmed exploitation by March 30, 2026.

Affected products: NetScaler ADC/Gateway 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and the FIPS/NDcPP variants, when configured as a SAML Identity Provider. Secure Private Access Hybrid deployments using affected instances are also vulnerable.

Remediation:

• Upgrade to Citrix’s fixed builds released June 30, 2026 (14.1-72.61, 14.1-72.61 FIPS, 13.1-63.18, 13.1-37.272)
• Disable SAML IdP configuration if patching cannot occur immediately
• Review /saml/login traffic and anomalous NSC_TASS cookie values for signs of probing
• Run watchTowr’s published detection script to test appliance exposure

Comparative Vulnerability Overview

Known Infection Vectors

• VPN credential theft and reuse infostealer malware, credential stuffing, and mass credential exposure (Fortibleed) give affiliates valid logins that bypass perimeter alerting entirely
• Authentication bypass via cookie/certificate forgery exploited in both the Palo Alto GlobalProtect (CVE-2026-0257) and Check Point (CVE-2026-50751) cases, allowing session establishment without any valid password
• Legacy protocol abuse continued use of the deprecated IKEv1 key-exchange protocol on Check Point gateways created an exploitable authentication gap
• Memory-disclosure exploitation of SAML-configured edge appliances crafted SAML/XML requests against Citrix NetScaler leak process memory that can support follow-on exploitation
• Phishing and spear-phishing used as a secondary initial-access method, particularly against employees with high-privilege access
• Rapid weaponization of newly disclosed PoCs threat actors, including Qilin affiliates, integrate public proof-of-concept exploit code into active campaigns within hours to days of release

Known Tools Used by Threat Actors

Targeted Industries

Analysis of confirmed ransomware activity tied to these VPN exploitation chains particularly Qilin, which is directly linked to the Check Point and Palo Alto flaws shows consistent sectoral targeting:

• Healthcare the most consistently targeted sector; hospitals hold highly sensitive data and face intense pressure to restore operations quickly, exemplified by the 2024 Synnovis/NHS attack that disrupted blood transfusion services across London
• Education school districts and universities, often under-resourced for detecting sophisticated intrusions
• Manufacturing industrial and conglomerate targets, including large multinational firms outside English-speaking markets
• Local government and municipal infrastructure city and county systems with high recovery urgency and comparatively limited security budgets
• Media and professional services organizations holding sensitive client and internal business data
• Critical infrastructure broadly flagged by CISA advisories referencing Qilin and related VPN-exploiting ransomware activity

Geographically, victims concentrate in the United States, United Kingdom, Australia, and Western Europe high-GDP markets with greater ransom-payment capacity and stronger data-protection regulatory exposure.

Common Vulnerabilities Exploited (Reference Table)

Full List of Indicators of Compromise (IOCs)

Palo Alto GlobalProtect (CVE-2026-0257) Arctic Wolf / Rapid7 Confirmed IOCs

Citrix NetScaler (CVE-2026-8451) watchTowr / Lupovis Confirmed IOCs

Check Point VPN (CVE-2026-50751) Behavioral Indicators

Fortinet FortiGate (FortiBleed) Exposure Indicators

Qilin Ransomware Group General IOCs and TTPs

MITRE ATT&CK Technique Mapping

Detection and Response Recommendations

Organizations running any of the four affected products should prioritize the following actions, ranked by urgency:

• Patch all internet-facing PAN-OS GlobalProtect, Check Point Security Gateway, Citrix NetScaler, and FortiGate appliances to the vendor-specified fixed versions immediately
• Rotate all administrative and VPN credentials on Fortinet devices, treating exposure as presumed unless independently verified otherwise
• Disable authentication override cookies (Palo Alto) and IKEv1 (Check Point) wherever legacy compatibility is not a hard requirement
• Enforce phishing-resistant MFA across every remote-access and administrative account, and disable or rename default “admin” accounts
• Extend EDR and behavioral monitoring coverage to Windows Subsystem for Linux (WSL) environments, given documented Qilin evasion techniques
• Monitor authentication logs for VPN sessions established without full password validation, unexpected hosting-provider source IPs, or hostnames such as “kali”
• Cross-reference firewall, EDR, and VPN authentication logs against the published IOC tables above, with particular attention to off-hours outbound transfers indicative of exfiltration staging
• Preserve all logs (EDR, Active Directory, VPN authentication, DNS, firewall) before any remediation or system rebuild if compromise is suspected, to support forensic investigation and regulatory notification timelines