Federal agencies are facing growing pressure to evaluate ZTNA as an alternative to traditional VPN architectures, as cybersecurity threats expose weaknesses in internet-facing remote access systems. While VPNs provide encrypted connections for remote users, ZTNA follows a zero-trust model that continuously verifies users, devices, and access requests rather than assuming that authenticated users should receive broad network access. The shift reflects a broader move away from the traditional "castle-and-moat" security model, where users inside an organization's network are generally trusted while those outside must first pass through a security perimeter. As organizations adopted cloud services, mobile workforces, and geographically distributed infrastructure, this model became more difficult to maintain.

VPN Security Risks Drive ZTNA Considerations

A traditional VPN creates an encrypted connection between a remote user's device and an organization's internal network. The VPN appliance typically sits at the edge of the network and remains accessible from the public internet, where it authenticates users before granting access. This architecture creates several security concerns. VPN appliances must maintain publicly accessible listening ports, making them discoverable and scannable by attackers. If vulnerabilities remain unpatched, those weaknesses can potentially be exploited remotely. The memorandum also points to risks involving legacy code bases, key-exchange processes, and lateral movement. Attackers who obtain legitimate VPN credentials, exploit a vulnerability, or hijack an active session may gain broad access to the internal network. Unlike application-specific access, traditional VPN access operates at the network layer, potentially allowing an authenticated user to reach multiple permitted subnets. Recent incidents involving vulnerable VPN appliances have further highlighted these concerns. The memorandum cites CISA directives addressing exploitation involving Pulse Connect Secure, VMware, and Ivanti Connect Secure products.

How ZTNA Changes Remote Access

ZTNA uses a "never trust, always verify" approach. Instead of treating users inside a network as inherently trusted, the architecture evaluates access requests based on factors such as identity, device health, user role, location, behavior, and risk. The architecture is built around three core components: the Policy Engine, which makes access decisions; the Policy Administrator, which establishes or ends sessions; and the Policy Enforcement Point, which enables, monitors, and terminates connections. Modern ZTNA deployments can also use outbound-only connections, removing the need for publicly accessible inbound listening ports. Rather than placing a user directly onto a corporate network, ZTNA can create an encrypted, application-specific micro-tunnel that limits the user to an authorized resource. Continuous verification is another key difference. Access is not necessarily granted once and maintained for the entire session. Instead, policies can reassess access based on changing security and contextual signals.

ZTNA Also Brings New Security Risks

The shift to ZTNA does not eliminate cybersecurity risks. The memorandum identifies the control plane as a significant concern because it is responsible for authentication, device verification, policy enforcement, and connection management. If an attacker compromises a ZTNA provider or components such as the Policy Engine or Policy Administrator, access decisions could potentially be manipulated. This could result in unauthorized access or prevent legitimate users from reaching resources. Additional security controls, including cryptographic signing of device nodes, may help reduce the impact of a compromised ZTNA provider. The memorandum cites Tailscale Tailnet Lock as an example of this approach.

Federal Agencies Face a Complex Transition

For federal agencies, moving from VPN to ZTNA involves more than replacing one remote-access technology with another. Agencies must consider federal cybersecurity policies, budgets, legacy infrastructure, authentication requirements, and cryptographic standards. NIST Special Publication 800-207 established foundational principles for Zero Trust Architecture, while Executive Order 14028 directed federal agencies toward zero trust, multifactor authentication, and secure cloud services. OMB Memorandum M-22-09 later established a federal zero-trust strategy centered on identity, devices, networks, applications and workloads, and data. A transition could involve assessing existing VPN deployments, identifying applications and user groups, deploying ZTNA alongside VPN infrastructure, and progressively migrating applications. VPN infrastructure could then be decommissioned after applications and users are migrated and validated. However, agencies must also account for recurring ZTNA subscription costs, legacy systems that may not support modern authentication, post-quantum cryptography requirements, NIST standards, FIPS requirements, and FedRAMP approval for cloud-based services. The transition from VPN to ZTNA therefore represents a broader change in how organizations approach remote access. While ZTNA can reduce exposure associated with publicly accessible network perimeters and broad network-level access, agencies must evaluate the technology's own control-plane risks, compliance requirements, costs, and technical limitations before making the shift.

Operation Endgame has dealt another blow to cybercriminal operations after international law enforcement agencies and private sector partners dismantled infrastructure supporting the SocGholish, Amadey, and StealC malware families. The coordinated operation resulted in the seizure of more than EUR 41 million in criminal cryptocurrency assets, the recovery of 27 million stolen login credentials, and the disruption of hundreds of servers and domains used to distribute malware.

Led by Europol and Eurojust, the operation brought together authorities from Canada, Denmark, Germany, the Netherlands, the United Kingdom, the United States, Microsoft, and several cybersecurity organizations. Officials said the objective was to disrupt the infrastructure cybercriminals rely on to launch ransomware attacks, financial fraud, and attacks against critical infrastructure.

Operation Endgame Targets Cybercrime Infrastructure

During the coordinated action, authorities targeted the infrastructure supporting malware delivery rather than focusing on a single malware family.

Law enforcement and industry partners took action against 326 servers and 142 domains, significantly disrupting malware distribution channels. Investigators also identified and restricted criminal cryptocurrency assets currently valued at more than EUR 41 million (USD 47 million) while recovering approximately 27 million stolen login credentials.

According to Europol, the operation aimed to disrupt the "assembly line" used by cybercriminals to gain initial access to victim systems before deploying ransomware or stealing sensitive information.

[caption id="attachment_112936" align="aligncenter" width="600"] Image Soure: Europol[/caption] [caption id="attachment_112937" align="aligncenter" width="600"] Image Source: Europol[/caption]

SocGholish, Amadey and StealC Malware Played Different Roles

The operation focused on three malware families that are commonly offered under the cybercrime-as-a-service model.

• SocGholish functioned as a malware loader that distributed fake browser updates through compromised WordPress websites. Users who installed these fake updates unknowingly infected their systems, allowing attackers to gain initial access and later deploy ransomware or other malicious tools.
• StealC malware primarily targeted sensitive information stored on infected devices, including passwords, authentication data, and digital identities. The stolen information was later used for fraud or traded within cybercriminal marketplaces.
• Amadey was mainly distributed through phishing campaigns. It provided attackers with initial access to compromised systems while also offering information-stealing capabilities that enabled the theft of sensitive user data.

Microsoft reported that during the first two weeks of May 2026 alone, Amadey and StealC malware were linked to more than 140,000 infected computers worldwide.

Thousands of Infected WordPress Sites Cleaned

One of the largest actions under Operation Endgame targeted SocGholish, also known as FakeUpdates.

Authorities remediated 14,971 infected WordPress websites, including websites belonging to restaurants, automotive repair businesses, and other organizations. Investigators also disabled the SocGholish botnet by taking control of domains and shutting down supporting servers.

Website owners whose credentials had been exposed were notified through platforms including Have I Been Pwned, DIVD, Spamhaus, CheckjeHack, NoMoreLeaks, Shadowserver, and NL-NCSC.

The Dutch Police urged WordPress administrators to change passwords, enable multi-factor authentication, remove unknown administrator accounts, and keep their websites updated to reduce future compromise risks.

SocGholish Linked to Evil Corp

Authorities said SocGholish has been linked to Evil Corp, a Russian cybercriminal group previously associated with the Zeus and Dridex malware families, as well as multiple ransomware and money laundering operations.

Rather than targeting only malware operators, investigators focused on disrupting the broader infrastructure supporting cybercriminal activity. Europol said this strategy increases operational costs for threat actors and makes large-scale cyberattacks more difficult to execute.

Europol Coordinates Global Cyber Operation

Europol's European Cybercrime Centre (EC3) coordinated operational intelligence sharing through SIENA while providing analytical, technical, and cryptocurrency tracing support throughout the investigation.

The operation forms part of Operation Endgame, described by Europol as the largest international initiative to disrupt ransomware enablers worldwide.

Officials said the latest disruption reflects a growing international strategy of targeting the infrastructure that enables cybercrime operations, rather than responding only after attacks have occurred.