The Citrix Bleed and Ivanti Chain playbooks cover two of the four major enterprise VPN platforms. Palo Alto GlobalProtect and Fortinet FortiGate are the other two, and both have been hit with critical exploitation chains that nation-state actors and ransomware affiliates weaponized rapidly.

Palo Alto PAN-OS (CVE-2024-3400): Command injection in the GlobalProtect gateway via the SESSID cookie. Unauthenticated, CVSS 10.0. Attackers write arbitrary files via path traversal, then trigger command execution through the telemetry service. Exploited as a zero-day by UTA0218 (suspected state-nexus) before disclosure. Creates a reverse shell from the firewall, which has visibility into every network segment it routes.

Fortinet FortiGate (CVE-2024-21762 + CVE-2024-47575 "FortiJump"): Out-of-bounds write in FortiOS SSL-VPN (21762) enabling unauthenticated RCE. FortiJump (47575) targets FortiManager, allowing unauthenticated attackers to execute code on the management plane that controls every FortiGate in the organization. Volt Typhoon and multiple ransomware affiliates exploit FortiGate devices. The FortiBleed credential extraction campaign (June-July 2026) exposed 73,000+ FortiGate admin credentials.

1. 1. Check for directory traversal and config extraction Search appliance logs and network telemetry for: path traversal sequences (../, ..%2f) in HTTP requests to management or VPN endpoints, HTTP responses with anomalously large payload sizes from configuration endpoints, and requests targeting session database files or certificate stores on the appliance. Zeek http.log: URI with traversal sequences to appliance IPs · Suricata ET EXPLOIT signatures
2. 2. Hunt for outbound connections FROM the appliance Firewalls and VPN concentrators should not initiate outbound connections to arbitrary external hosts. Search for: reverse shells (outbound TCP from appliance management IP to external IPs on non-standard ports), DNS queries from the appliance to unexpected resolvers, and outbound HTTP/HTTPS from the appliance to non-vendor update destinations. Zeek conn.log: src_ip == appliance_mgmt AND dst_ip external · Firewall self-traffic logs
3. 3. Parse crash logs for shellcode indicators Some exploitation techniques trigger controlled crashes that execute shellcode during error handling. Search appliance crash/diagnostic logs for: unexpected core dumps, crash reports correlating with external HTTP requests, and diagnostic files containing binary data or encoded payloads. Appliance diagnostics: crash log timestamps correlated with HTTP access logs
4. 4. Verify firmware integrity and check for persistence Compare running firmware hashes against vendor-published hashes. Check for: modifications to system files, new cron jobs or scheduled tasks on the appliance OS, and unauthorized admin accounts or SSH keys. Some implants survive firmware upgrades by modifying the upgrade process itself. Vendor integrity tools · Hash verification · SOHO Router (same firmware integrity pattern)
5. 5. Audit all VPN sessions and admin access Check for: admin logins from unexpected IPs, VPN sessions established without corresponding MFA events, concurrent sessions from the same user at different locations, and configuration changes made outside change management windows. FortiBleed specifically targeted admin credential extraction. Edge Device playbook · Admin session audit · MFA correlation

Edge Device Compromised (full edge device triage)
Citrix Bleed + Ivanti Chain (the other two edge pillars)
Volt Typhoon (FortiGate exploitation for critical infrastructure access)