Ransomware Gangs Attack Palo Alto, Fortinet, Citrix, and Check Point VPNs to Target Corporate Networks

A coordinated wave of exploitation targeting edge VPN and firewall appliances from four major vendors Palo Alto Networks, Fortinet, Citrix, and Check Point has emerged as the dominant initial-access vector for ransomware operators in mid-2026. Threat actors, including affiliates of the Qilin ransomware-as-a-service (RaaS) operation, are chaining authentication-bypass flaws, credential-harvesting campaigns, and legacy-protocol weaknesses to obtain unauthenticated or credential-free access to corporate perimeters. Once inside, these actors move rapidly toward lateral movement, data exfiltration, and double-extortion ransomware deployment, often within days of a CVE’s public disclosure. VPN Ransomware Attack Chain (Image...

Read the full article at the source.