Blog / Ransomware & Network Security
Ransomware's favorite front door is the security box nobody patches
A fresh threat report making the rounds this week describes how affiliates of the Qilin ransomware operation have been breaking into company networks — and the entry point is the punchline. Not a phishing email. Not a weak password. The firewall/VPN appliance itself: a vulnerability in Palo Alto Networks' GlobalProtect VPN (CVE-2026-0257) that, on unpatched devices with certain settings, let attackers establish a VPN session with no credentials at all. Once inside, they dumped passwords from memory, spread with standard admin tools, installed commercial remote-access software, stole data, wiped the event logs, and encrypted everything.
Here's the detail every business owner should sit with: the vendor shipped a fix on May 13. Researchers saw active exploitation by May 17. Four days. If your security appliance's firmware updates happen "when someone gets around to it," you are permanently behind that clock.
Your firewall is a computer too
Businesses tend to think of the firewall as a sealed appliance — install it, configure it once, trust it forever. It's actually a computer running software, exposed to the entire internet by design, holding the keys to everything behind it. That makes it the single most attractive target on your network, and attackers have noticed: edge devices — firewalls, VPN gateways, remote-access appliances — have become one of ransomware's most common entry points, across every major vendor, year after year. This isn't a Palo Alto problem; it's a pattern. The device you bought to be secure is only secure if someone maintains it.
And unlike a phishing email, there's no employee in the loop to catch it. Between our posts on ClickFix malware tricking users and AI agents running attacks at machine speed, this completes the set: attackers come through the human door, and they come through the hardware door — whichever opens first.
What this attack chain teaches — and the defense for each step
- Entry: an unpatched, internet-facing device. Firewall and VPN firmware belongs on a patch schedule with the same priority as Windows updates — arguably higher, since these boxes face the internet directly. Four-day exploit windows mean "quarterly maintenance" isn't a security posture.
- No credentials required — but credentials were the next stop. The attackers' first move inside was harvesting passwords. MFA on VPN and remote access, plus not reusing admin passwords across systems, limits how far a breached edge device takes them.
- They installed AnyDesk and other remote-access tools. Unexpected remote-access software appearing on a machine is a screaming alarm — if anything is listening. Behavior-based EDR/MDR flags exactly this; unmonitored networks find out at encryption time.
- They cleared the event logs. Attackers routinely destroy local evidence. Logs that ship off-device in real time (part of managed monitoring) can't be wiped by the intruder.
- They stole data, then encrypted. Double extortion is standard now — and recovery still comes down to tested backups the attacker couldn't reach. Our piece on why backups must be offline covers what "couldn't reach" actually requires.
Three questions to ask this week
You don't need to know your firewall's model number to act on this. Ask whoever manages your network — internal or outsourced:
- "When was our firewall's firmware last updated, and who's responsible for the next one?" A specific date and a name is a good answer. A pause is not.
- "Does our VPN require MFA?" If a password (or in this case, nothing) is enough to get inside the network, that's the to-do list's new top item.
- "Would we notice a stranger on the network?" Not "do we have a firewall" — would anything alert a human if an unknown VPN session started at 2 a.m. and began touching servers?
For our managed clients, those answers are: on a schedule with alerts, yes, and yes — firewall firmware is in the same patch-and-monitor loop as every workstation and server, remote access is MFA-gated, and a 24/7 detection stack watches for exactly the lateral-movement behavior in this report.
Not sure what's guarding your front door right now — or when it was last updated? Ask us. A ten-minute look at your edge is cheaper than meeting Qilin through it.