The Check Point VPN story in this week’s news mentions a “Qilin ransomware affiliate” — and that word, affiliate, is worth a minute of your time. Ransomware groups like Qilin don’t run every attack themselves. They operate ransomware-as-a-service: the core group builds the malware, runs the leak site and handles ransom payments, then leases the toolkit to independent criminals — affiliates — who do the actual break-ins and keep most of the profit, as covered by Help Net Security.

Think of it like a franchise. Head office supplies the branding, the product and the playbook; the franchisee does the legwork. It’s why “Qilin” can hit a hospital in one country and a manufacturer in another within the same week — those are different crews using the same kit.

Why does this matter to your business? Because affiliates don’t hand-pick prestigious targets. They scan the internet for whatever is unpatched or poorly secured — like VPN gateways with old protocols enabled — and work through the list. Being small or low-profile isn’t a defence. If your kit is exposed, you’re on the list.

The practical takeaway: keep internet-facing systems patched, turn on multi-factor authentication everywhere, and ask your IT provider one good question — “if someone logged into our VPN with a stolen or bypassed credential, would we notice?” If the answer is fuzzy, our managed cybersecurity service and team security training are built for exactly that gap.