Ransomware Gangs Attack Palo Alto, Fortinet, Citrix, and Check Point VPNs to Target Corporate Networks

Key Takeaways

• Ransomware groups, notably Qilin, are actively exploiting vulnerabilities and weaknesses in VPN and firewall appliances from Palo Alto Networks, Fortinet, Citrix, and Check Point.
• The attacks leverage authentication bypasses, credential harvesting, and memory disclosure flaws to gain initial access to corporate networks.
• The affected vendors have released patches and mitigation guidance, but rapid exploitation by threat actors leaves a narrow window for defense.
• Organizations in healthcare, education, manufacturing, and government are primary targets, particularly in high-GDP regions.

A coordinated series of attacks targeting critical network edge infrastructure from four prominent cybersecurity vendors—Palo Alto Networks, Fortinet, Citrix, and Check Point—has emerged as a primary vector for ransomware operations in mid-2026. Threat actors, including affiliates of the Qilin ransomware-as-a-service (RaaS) group, are exploiting authentication bypass flaws, conducting credential-harvesting campaigns, and leveraging weaknesses in legacy protocols to achieve unauthenticated or credential-free access to enterprise perimeters.

Once inside, these attackers quickly move to establish lateral movement, exfiltrate sensitive data, and deploy double-extortion ransomware, frequently within days of a vulnerability’s public disclosure. The campaigns highlight a concerning trend where internet-facing remote access infrastructure has become the preferred entry point for the ransomware ecosystem.

The Four Converging Incidents

The analyzed campaigns encompass four distinct, yet interconnected, incidents:

• The “Fortibleed” campaign, a large-scale credential compromise affecting approximately 75,000 internet-facing FortiGate firewalls.
• Active exploitation of the Palo Alto GlobalProtect authentication-bypass vulnerability, CVE-2026-0257.
• Qilin-linked exploitation of the Check Point VPN authentication-bypass flaw, CVE-2026-50751, which is tied to the deprecated IKEv1 protocol.
• Rapid in-the-wild abuse of a new CitrixBleed-style NetScaler memory-disclosure bug, CVE-2026-8451.

Why VPN Gateways Have Become the Preferred Entry Point

Enterprise VPN and firewall appliances are strategically positioned at the network edge, designed for internet accessibility, and often run outdated firmware or legacy protocols that organizations are hesitant to disable due to compatibility concerns. This combination presents an attractive target for ransomware affiliates who seek a swift, stealthy path into internal networks, bypassing typical endpoint detection tools.

Successful authentication bypass or credential theft against a VPN concentrator allows an attacker to enter as a “legitimate” remote user, effectively circumventing most perimeter-focused security controls. The speed at which these vulnerabilities are weaponized has also accelerated dramatically. For instance, the Palo Alto GlobalProtect flaw was exploited within days of public proof-of-concept code release, and attacks against the Citrix NetScaler flaw began less than 24 hours after Citrix’s July 2026 disclosure. This compressed exploitation window leaves defenders with minimal time between patch availability and active abuse.

Campaign 1: Fortibleed Mass FortiGate Credential Compromise

The “Fortibleed” campaign, first detected in mid-June 2026, involves a large-scale credential-harvesting operation where threat actors systematically extracted configuration files from internet-facing Fortinet FortiGate firewalls and subsequently cracked the stored password hashes. Independent analysis by Kevin Beaumont, Hudson Rock, and SOCRadar identified valid administrator and SSL VPN credentials for approximately 30,791 to 75,000 devices across 194 countries and over 21,000 domains. This represents nearly half of all internet-facing FortiGate appliances visible on Shodan.

Unlike a single CVE exploit chain, Fortibleed is the culmination of previously identified FortiOS credential-storage weaknesses, combined with the use of weak or reused passwords and unpatched appliances exposed to the internet. Researchers caution that any organization whose data appeared in the exposed dataset should assume their network perimeter has been compromised.

Campaign 2: Palo Alto GlobalProtect Authentication Bypass (CVE-2026-0257)

Palo Alto Networks disclosed CVE-2026-0257 on May 13, 2026, detailing an authentication-bypass vulnerability (CWE-565) affecting the GlobalProtect portal and gateway components of PAN-OS. The flaw stems from PAN-OS trusting any decryptable authentication override cookie without verifying its legitimate origin. If the same certificate is used for both the GlobalProtect HTTPS service and cookie encryption, an attacker can retrieve the certificate chain from the public HTTPS service and forge valid cookies for any user, including administrators.

Exploitation requires three specific conditions: GlobalProtect portal or gateway enabled, authentication override cookies enabled (which is not the default configuration), and certificate reuse or exposure. Rapid7 published a working proof-of-concept on May 29, 2026, leading Palo Alto to revise the CVSS score from an initial 4.7 to 7.8. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the same day. Active exploitation was confirmed as early as May 17, 2026, and by July 2026, Qilin ransomware affiliates were confirmed to be abusing this flaw to gain unauthorized VPN access to unpatched networks. In observed intrusions, threat actors forged authentication override cookies for privileged accounts, including default “admin” accounts, to establish VPN sessions without requiring credentials or MFA. They then utilized post-exploitation tools like Impacket and NTLM relay attacks for configuration retrieval, IPsec tunnel establishment, and lateral movement.

Affected products:

PA-Series and VM-Series firewalls and Prisma Access running PAN-OS with GlobalProtect enabled and authentication override cookies configured. Cloud NGFW is not affected.

Check Point VPN IKEv1 Authentication Bypass (CVE-2026-50751)

Check Point disclosed CVE-2026-50751 (CVSS 9.3) on June 8, 2026, issuing a warning about active exploitation of a logic-flow weakness in certificate validation. This vulnerability impacts Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key-exchange protocol. The flaw allows an unauthenticated remote attacker to bypass user authentication and establish a VPN session without a valid password.

Several conditions must align for exploitation: VPN Remote Access or Mobile Access enabled, IKEv1 enabled for remote access, gateways accepting legacy Remote Access clients, and no machine-certificate requirement. Check Point confirmed that attacks against this flaw began as early as May 7, 2026, a full month before public disclosure, and intensified in early June. Crucially, Check Point confirmed that a Qilin ransomware affiliate exploited this vulnerability in post-compromise activities against victim organizations. WatchTowr Labs later detailed how attackers manipulated authentication flags via a custom VPNExtFeatures Vendor ID payload during IKEv1 negotiation to achieve a complete authentication bypass.

A related flaw, CVE-2026-50752 (CVSS 7.4), affects certificate validation in IKEv1 and could facilitate adversary-in-the-middle attacks against site-to-site VPN connections, though no in-the-wild exploitation of this second bug has been confirmed.

Affected products:

Security Gateways R82.10 JHF Take 19 or below, R82 JHF Take 103 or below, R81.20 JHF Take 141 or below, R81.10/R81/R80.40 (all end-of-support), and Spark Firewalls R80.20.X/R81.10.X/R82.00.X.

Campaign 4: Citrix NetScaler CitrixBleed-Style Memory Disclosure (CVE-2026-8451)

Citrix disclosed six vulnerabilities in NetScaler ADC and NetScaler Gateway on June 30, 2026. The most critical of these is CVE-2026-8451 (CVSS 8.8), a pre-authentication out-of-bounds read in NetScaler’s XML/SAML parser. This flaw can leak fragments of appliance memory via the NSC_TASS cookie when a device is configured as a SAML Identity Provider.

Researchers have categorized this vulnerability within the “CitrixBleed” family, alongside the original CVE-2023-4966, CitrixBleed 2 (CVE-2025-5777), and CitrixBleed 3 (CVE-2026-3055), all of which were rapidly weaponized by ransomware actors post-disclosure. Exploitation attempts for CVE-2026-8451 began less than 24 hours after its public release. Security firm Lupovis observed threat actors probing exposed NetScaler systems with malformed <samlp:AuthnRequest> payloads padded with hundreds of spaces, a pattern consistent with watchTowr’s published detection artifact. One such campaign was traced to the IP address 146.70.139[.]154.

Unlike earlier CitrixBleed variants that could leak kilobytes of memory, including session tokens, CVE-2026-8451 leaks only small memory fragments per request. While it has not been confirmed to directly expose credentials or session IDs, repeated requests could still reveal process memory pointers useful for subsequent exploitation. This flaw closely follows CVE-2026-3055 (CVSS 9.3), a related NetScaler memory-overread bug patched in March 2026, which saw active reconnaissance within days and confirmed exploitation by March 30, 2026.

Affected products:

NetScaler ADC/Gateway 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and their FIPS/NDcPP variants, when configured as a SAML Identity Provider. Secure Private Access Hybrid deployments using affected instances are also vulnerable.

Comparative Vulnerability Overview

Known Infection Vectors

• VPN credential theft and reuse: Infostealer malware, credential stuffing, and mass credential exposure (Fortibleed) provide attackers with valid logins that bypass perimeter alerts entirely.
• Authentication bypass via cookie/certificate forgery: Exploited in both the Palo Alto GlobalProtect (CVE-2026-0257) and Check Point (CVE-2026-50751) cases, allowing session establishment without any valid password.
• Legacy protocol abuse: Continued use of the deprecated IKEv1 key-exchange protocol on Check Point gateways created an exploitable authentication gap.
• Memory-disclosure exploitation of SAML-configured edge appliances: Crafted SAML/XML requests against Citrix NetScaler leak process memory that can support follow-on exploitation.
• Phishing and spear-phishing: Used as a secondary initial-access method, particularly targeting employees with high-privilege access.
• Rapid weaponization of newly disclosed PoCs: Threat actors, including Qilin affiliates, integrate public proof-of-concept exploit code into active campaigns within hours to days of release.

Known Tools Used by Threat Actors

Targeted Industries

Analysis of confirmed ransomware activity linked to these VPN exploitation chains, particularly Qilin (directly associated with the Check Point and Palo Alto flaws), reveals consistent sectoral targeting:

• Healthcare: The most consistently targeted sector; hospitals possess highly sensitive data and face intense pressure to restore operations quickly, as exemplified by the 2024 Synnovis/NHS attack that disrupted blood transfusion services across London.
• Education: School districts and universities, often under-resourced for detecting sophisticated intrusions.
• Manufacturing: Industrial and conglomerate targets, including large multinational firms outside English-speaking markets.
• Local government and municipal infrastructure: City and county systems with high recovery urgency and comparatively limited security budgets.
• Media and professional services: Organizations holding sensitive client and internal business data.
• Critical infrastructure: Broadly flagged by CISA advisories referencing Qilin and related VPN-exploiting ransomware activity.

Geographically, victims are concentrated in the United States, United Kingdom, Australia, and Western Europe—high-GDP markets with greater ransom-payment capacity and stronger data-protection regulatory exposure.

Common Vulnerabilities Exploited (Reference Table)

Full List of Indicators of Compromise (IOCs)

Palo Alto GlobalProtect (CVE-2026-0257) Arctic Wolf / Rapid7 Confirmed IOCs

Citrix NetScaler (CVE-2026-8451) watchTowr / Lupovis Confirmed IOCs

Check Point VPN (CVE-2026-50751) Behavioral Indicators

Fortinet FortiGate (FortiBleed) Exposure Indicators

Qilin Ransomware Group General IOCs and TTPs

MITRE ATT&CK Technique Mapping

What You Should Do

Organizations operating any of the four affected products should prioritize the following actions to mitigate risk:

• Immediately patch all internet-facing PAN-OS GlobalProtect, Check Point Security Gateway, Citrix NetScaler, and FortiGate appliances to the vendor-specified fixed versions.
• Rotate all administrative and VPN credentials on Fortinet devices, assuming compromise unless independently verified otherwise.
• Disable authentication override cookies (Palo Alto) and IKEv1 (Check Point) wherever legacy compatibility is not a strict requirement.
• Enforce phishing-resistant Multi-Factor Authentication (MFA) across all remote-access and administrative accounts, and disable or rename default “admin” accounts.
• Extend Endpoint Detection and Response (EDR) and behavioral monitoring coverage to Windows Subsystem for Linux (WSL) environments, given documented Qilin evasion techniques.
• Monitor authentication logs for VPN sessions established without full password validation, unexpected hosting-provider source IPs, or suspicious hostnames such as “kali.”
• Cross-reference firewall, EDR, and VPN authentication logs against the published IOC tables, paying close attention to off-hours outbound transfers that could indicate exfiltration staging.
• Preserve all logs (EDR, Active Directory, VPN authentication, DNS, firewall) before any remediation or system rebuild if a compromise is suspected, to support forensic investigation and regulatory notification timelines.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.