Check Point Remote Access VPN and Mobile Access

The flaw exists because the system failed to properly enforce authentication checks when a connection request arrived via the legacy IKEv1 protocol. IKEv1 is an older standard for negotiating encrypted connections that lacks the stricter validation controls present in its successor, IKEv2. By targeting this deprecated pathway, attackers could slip through without presenting valid credentials.

An attacker identifies a Check Point gateway still accepting IKEv1 connections — a configuration that is common in older enterprise deployments. They send a specially crafted connection request that exploits the authentication bypass, gaining VPN access to the network without credentials. From there, post-compromise activity consistent with the Qilin ransomware (ransomware — malicious software that encrypts your files and demands payment to restore them) operation has already been observed in at least one confirmed case. Attacks began in early May and surged in early June.

1. Review VPN authentication logs for successful connections from unrecognised IP addresses, particularly those that completed via IKEv1 without a machine certificate.
2. Monitor for unusual lateral movement (the technique of moving through a network after initial access, accessing systems beyond the original entry point) or access to sensitive internal systems shortly after a new VPN session is established.
3. Check Point has released updated IPS signatures — confirm these are downloaded and active on your gateway.

1. Apply Check Point's security update immediately. Patch notes are available in the official advisory.
2. If patching is not immediately possible: remove support for the legacy remote access client, restrict VPN authentication to IKEv2 only, and set machine certificate authentication as mandatory.
3. Enable IPS and download the latest signatures from Check Point's update feed.