SSL VPN appliances are the initial access vector of 2026, and this week makes the case definitively. Qilin ransomware is actively exploiting a critical authentication bypass in Palo Alto GlobalProtect, two chained SonicWall SMA1000 zero-days have been under exploitation since June 22, and a novel malware family is hiding command-and-control traffic inside Microsoft 365 calendar invites. If your organization still runs SSL VPN concentrators as the primary remote access method, the attack surface discussion is no longer theoretical.

In the News

Qilin Ransomware Exploiting Critical GlobalProtect VPN Authentication Bypass

The Qilin ransomware group — one of the most active ransomware-as-a-service operations in 2026 — is now confirmed to be exploiting a critical authentication bypass vulnerability in Palo Alto Networks GlobalProtect VPN. The flaw allows unauthenticated remote attackers to bypass VPN authentication entirely, providing direct initial access to the internal network without credentials.

This is not a theoretical proof of concept. BleepingComputer reports confirmed breaches attributed to this vector, with Qilin operators using the access to deploy ransomware after lateral movement through the compromised environment. The attack chain follows the now-standard pattern for VPN appliance exploitation: bypass authentication, establish persistence, move laterally using legitimate tools, exfiltrate data, then encrypt.

The broader pattern is unmistakable. VPN appliance vulnerabilities — Ivanti, Fortinet, and now Palo Alto — have become the dominant initial access vector for ransomware in 2026 (MITRE ATT&CK T1133 — External Remote Services, T1190 — Exploit Public-Facing Application). Every organization running GlobalProtect should treat this as an emergency patch cycle.

What defenders should do: Patch GlobalProtect immediately. Enforce phishing-resistant MFA (FIDO2) on all VPN endpoints. Review VPN authentication logs for anomalous successful authentications from unexpected source IPs. Accelerate zero trust network access (ZTNA) migration plans — the SSL VPN appliance attack surface is not defensible at the current pace of zero-day disclosure.

HollowGraph Malware Hides C2 Commands in Microsoft 365 Calendar Events

A newly documented malware family called HollowGraph represents a significant evolution in command-and-control technique. Rather than communicating with attacker-controlled infrastructure over the network, HollowGraph uses the Microsoft Graph API to read and write calendar events in a compromised user’s Microsoft 365 account. Commands are embedded in calendar events dated far into the future — 2050 — where they are unlikely to be noticed by the user or flagged by standard monitoring.

The technique is effective because every byte of C2 traffic flows over legitimate Microsoft API endpoints (graph.microsoft.com), using valid OAuth tokens. Network-layer inspection sees standard HTTPS traffic to Microsoft. DNS monitoring sees graph.microsoft.com. No traditional indicator of compromise exists at the network layer. Exfiltrated data follows the same path — encoded and stored as calendar event descriptions.

Detection requires visibility into Microsoft 365 API-layer behavior: anomalous Graph API call patterns, calendar events created programmatically with dates far outside normal scheduling windows, and OAuth token usage patterns inconsistent with the user’s baseline. This is a CASB and cloud-native detection problem, not a network monitoring problem (MITRE ATT&CK T1102.002 — Web Service: Bidirectional Communication).

What defenders should do: Deploy inline CASB with Microsoft 365 API visibility. Monitor Graph API audit logs for programmatic calendar event creation, especially events with dates beyond a reasonable scheduling horizon. Review OAuth application consent grants in Entra ID for unexpected Graph Calendar permissions.

Two SonicWall SMA1000 Zero-Days Exploited Since June 22

Threat actor UTA0533 has been exploiting two chained zero-day vulnerabilities in SonicWall SMA1000 appliances since at least June 22 — nearly four weeks before SonicWall released patches on July 18. CVE-2026-15409 (CVSS 9.8) enables unauthenticated remote code execution, and CVE-2026-15410 (CVSS 9.1) provides a privilege escalation path to root. Chained together, they give an attacker complete control of the appliance.

UTA0533 used the access to deploy custom persistent malware designed to survive firmware updates — a level of sophistication that indicates a well-resourced threat actor with specific interest in maintaining long-term access through SSL VPN appliances. The four-week exploitation window before patch availability underscores the fundamental risk of edge appliance architectures: when the appliance itself is the vulnerability, there is no compensating control that can fully substitute for vendor patching speed.

Organizations running SonicWall SMA1000 appliances should patch immediately and perform forensic review of appliance logs and filesystem integrity from June 22 forward. The custom malware’s persistence mechanism means patching alone may not be sufficient — reimaging the appliance to factory state before applying the patched firmware is the conservative approach (MITRE ATT&CK T1190, T1078 — Valid Accounts).

What defenders should do: Patch SonicWall SMA1000 to the latest firmware immediately. Reimage appliances to factory state before patching if possible. Review appliance logs for anomalous activity from June 22 onward. Evaluate ZTNA as a replacement architecture for SSL VPN appliances.

Russian GRU Hijacking IP Cameras Across Europe to Surveil NATO Logistics

Dutch intelligence confirmed that Russian GRU units are systematically compromising internet-connected security cameras across Europe to monitor NATO and Ukraine military logistics — weapons shipments, troop movements, and supply chain routes — in real time. The campaign targets commodity IP cameras with default credentials and unpatched firmware, converting physical security infrastructure into an intelligence collection platform.

This is not a sophisticated supply-chain attack. The entry vector is default credentials and missing firmware updates on internet-exposed cameras — the most basic IoT security failure. The sophistication lies in the operational use: correlating camera feeds across multiple geographic locations to build real-time logistics intelligence. For critical infrastructure and defense-adjacent organizations, every unmanaged IoT device on the network is a potential surveillance endpoint.

What defenders should do: Inventory all IP cameras and IoT devices on the network. Segment IoT devices onto dedicated VLANs with no access to enterprise or OT networks. Change all default credentials. Apply firmware updates. For organizations in critical infrastructure, logistics, or defense sectors, conduct a specific review of internet-exposed camera inventory.

Defender Action Items

  • Patch GlobalProtect VPN to the latest PAN-OS version immediately — active ransomware exploitation confirmed
  • Patch SonicWall SMA1000 to latest firmware; reimage to factory state before applying patch if possible; review logs from June 22 forward
  • Audit Microsoft 365 Graph API permissions — review OAuth app consent grants in Entra ID for unexpected Calendar.ReadWrite scopes
  • Deploy CASB with M365 API visibility to detect calendar-based C2 techniques like HollowGraph
  • Inventory and segment IoT devices — especially IP cameras — onto isolated VLANs with enforced access control
  • Update 7-Zip to 26.02 across all endpoints — CVE-2026-14266 (CVSS 7.8) heap buffer overflow in XZ handling enables RCE

Detection Queries

The following Splunk SPL query identifies anomalous Microsoft Graph API calendar event creation — specifically events with start dates more than two years in the future, which is a behavioral indicator for HollowGraph-style C2 embedding. This approach targets the technique rather than specific IOCs.

index=o365 sourcetype="o365:management:activity" Workload=MicrosoftGraph Operation="Create" ResourceType="event"
| eval event_start=strptime('Start.DateTime', "%Y-%m-%dT%H:%M:%S")
| eval years_ahead=round((event_start - now()) / 86400 / 365, 1)
| where years_ahead > 2
| stats count by UserId, ClientAppId, ClientIP, years_ahead
| where count > 3
| sort -count

Tune the years_ahead threshold based on your environment — legitimate scheduling rarely exceeds 18 months. False positives may include automated systems that create recurring events with distant end dates. Correlate ClientAppId against your approved OAuth application inventory in Entra ID.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.