Ransomware Groups Now Target VPN and Firewall Appliances as the Primary Entry Point

Here is the pattern that defined the first half of 2026: attackers are not breaking in through phishing emails nearly as often as they used to. They are finding internet-facing VPN gateways, firewalls, and remote access appliances that have not been patched and walking right in. Check Point, Palo Alto, Fortinet, and Cisco SD-WAN products have all had critical vulnerabilities actively exploited in 2026 — often before patches were even publicly available. One ransomware-linked threat actor is confirmed to be systematically targeting vulnerable VPN appliances across all four of those vendors simultaneously. CISA has added over a dozen network appliance vulnerabilities to its known exploited list this year alone. The business implication is this: your network perimeter is your highest-priority attack surface right now. Any internet-facing firewall, VPN gateway, or remote access device that has not been patched in the last 90 days should be treated as potentially compromised. Patch these devices first, before endpoints, before servers. And make sure someone is accountable for tracking patch status on your perimeter gear on at least a monthly basis.