A Check Point IKEv1 authentication bypass was exploited for a month before disclosure, with at least one intrusion linked to a Qilin ransomware affiliate.