Qilin and Inc Ransomware Chained PAN-OS Auth Bypass for Months

The perimeter box is the payload now. Unit 42 confirmed on Monday that ransomware operators — Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) — are still actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect portals and gateways, to walk straight past MFA and establish VPN sessions inside corporate networks. Public reporting also ties the bug to crews deploying Settra ransomware. Victims span education, finance, healthcare, government, utilities, manufacturing and more — and the post-exploitation playbook ends at your hypervisors.

What makes this one sting is the timeline. The bug was patched and KEV-listed in May, exploitation started within days, and five months later multiple ransomware groups are still farming unpatched gateways. If your PAN-OS or Prisma Access estate hasn't been updated, you are not dealing with a theoretical risk — you're dealing with a race condition you may already have lost.

The Return

Verdict: Act now

Who's exposed

Any organisation running an unpatched PAN-OS GlobalProtect portal or gateway — or Prisma Access — is exposed to a KEV-listed auth bypass that at least three ransomware crews have chained into full intrusions since May, ending in domain-wide credential theft and ESXi-level encryption.

Do this now

Patch PAN-OS/Prisma Access to a fixed version or apply the vendor workarounds immediately.
Hunt GlobalProtect logs for Unit 42's IOCs: nine IPs, bogus MACs/hostnames, and hard-coded PoC client strings.
Treat any matching gateway-connected event as a breach: trigger IR, rotate domain credentials, check vCenter/ESXi.
Test management interfaces from outside for exposure on ports 4443 and 3879; lock down Interface Management profiles.
Audit ESXi execInstalledOnly settings and Veeam servers for CVE-2023-27532 patching.

The timeline: patched in May, pwned by mid-May

Let's reconstruct this in order, because the sequence is the story.

May 13. Palo Alto Networks disclosed and patched CVE-2026-0257 (CVSS 7.8), initially rating it medium severity and saying it knew of exploitation attempts but had observed no malicious exploitation, according to The Register. CISA added it to the Known Exploited Vulnerabilities catalog the same day. The flaw itself: an authentication bypass in the GlobalProtect portal and gateway components that lets an unauthenticated attacker circumvent security controls and initiate VPN connections.

May 17 onward. That initial assessment aged fast. By the end of May, Rapid7 researchers reported successful exploitation across multiple customer environments dating back to at least May 17 — four days after the patch. May 29 is the line Unit 42 draws between pre-proof-of-concept and post-PoC activity, which matters for how you hunt (more on that below).

Early June. Unit 42's threat brief says its investigations into intrusions abusing the bug have been running since early June, across eleven named industries. In July, Arctic Wolf flagged Qilin exploiting the same CVE in operations ranging from rapid encryption-only hits to full double-extortion, per The Hacker News. ReliaQuest then detected both Qilin and Settra operators using it, and on October 19 Unit 42 updated its brief to confirm Qilin and Inc are still at it — nearly five months of sustained ransomware chaining against one perimeter CVE.

That's the classic KEV failure mode: a fix exists, the advisory ships, and a fat slice of the internet simply never patches. The attackers don't need a zero-day when a 158-day-old CVE works fine.

The primitive: bypass the portal, inherit the trust

Here's the mechanic, at the level of detail the reporting supports. GlobalProtect's portal handles authentication and config delivery; the gateway terminates VPN sessions. CVE-2026-0257 lets an attacker bypass the portal's authentication controls and initiate a VPN connection — which then also sidesteps MFA, because the session was never properly authenticated in the first place. You can't MFA your way out of a bug that skips the authentication step entirely. It's the lockpick-not-brute-force distinction: nothing to rate-limit, nothing to alert on a failed login, because there is no failed login.

Unit 42 is careful about what's confirmed versus assumed: only a small portion of probed devices actually established VPN sessions, producing gateway-connected events, and in its earliest observations no post-access behavior or lateral movement was identified. The ransomware cases documented since June are a separate, later phase — that's when the playbook gets loud. So a gateway-connected event matching these indicators isn't proof of ransomware, but Unit 42's guidance is unambiguous: treat it as an incident, not a curiosity.

The post-exploitation chain Unit 42 describes is bread-and-butter ransomware tradecraft with one nasty twist:

Gain the foothold via CVE-2026-0257 and establish a VPN session, bypassing MFA.
Recon the internal network using dual-use RMM tooling — legitimate software doing illegitimate work, so it blends in.
Move laterally over RDP and SMB.
Stage credential-harvesting and exfiltration tooling, then deploy ransomware.

The boss fight: offline credential dumping from a VMDK

Now the twist, and credit where it's due — this is genuinely clever offensive work, however much we dislike who's doing it. Unit 42's Andy Piazza describes a case where attackers pivoted from the compromised VPN gateway to the vCenter management appliance. From there they disabled the execInstalledOnly security control on ESXi hypervisors and ran a custom tool that dumped credentials offline, directly from a domain controller's virtual disk (VMDK).

Think about why that's brutal. Your EDR lives in the guest OS. If the attacker operates at the hypervisor layer and reads the domain controller's disk without ever executing anything inside the guest, the in-guest telemetry you paid for sees nothing. It's the security equivalent of looting a save file from disk instead of fighting the boss in-game. Unit 42 calls it a highly sophisticated method for obtaining domain-wide credentials, and for once that adjective is earned — the sources demonstrate why.

Illustration of a hand extracting a key from beneath a stack of virtual machines — Reading a domain controller's VMDK offline bypasses every in-guest control — including EDR.

And because one foothold is never enough, Unit 42 observed actors chaining the PAN-OS access with exploitation of CVE-2023-27532 against Veeam backup infrastructure — hit the backups before you hit production, so the victim has nothing clean to restore from. If your ransomware response plan assumes your backups survive, this pairing should keep you up tonight. We've covered similarly methodical chaining before, in our look at a root exploit built from a 37-year-old bug: patient attackers assembling reliable chains from parts defenders forgot about.

The misconfiguration multiplier on your management interface

Buried in the October 20 update is a finding that deserves its own ticket queue. During IR engagements associated with the Lunar Peak campaign, Unit 42 kept finding the same mistake: organizations had mapped GlobalProtect profiles to HTTP/HTTPS services on their management interfaces, inadvertently exposing the management plane to the internet on ports 4443 and 3879 — often without anyone knowing. A CVE in GlobalProtect plus an internet-facing management interface is a compounding error, and the attackers only need you to make it once.

The verification step is refreshingly low-tech, and you can do it from a coffee shop: from an external network, try an out-of-band HTTPS connection to your management IP on 4443 and 3879. If it answers, you have a problem. The fix is proper Interface Management profile configuration per Palo Alto Networks' documentation — restrict management access, enforce least privilege, and don't let GP profiles touch the management plane.

How to hunt this today

Unit 42 split its indicators by phase, and the split is operationally useful. For pre-PoC activity (before May 29), search GlobalProtect logs for successful login connections from nine IPs, including 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60 and 202.144.192[.]47. Then look for gateway-connected events using obviously synthetic host identifiers — the PoC and tooling leave fingerprints like aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, and device names such as WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. Real fleets have messy, varied hostnames; uniform placeholder values are the tell.

For post-PoC activity, the public exploit hard-codes its client configuration, so hunt for successful gateway-connected events matching:

endpoint_os_version : "Microsoft Windows 10 Pro 64-bit"
source_user_info.domain : (empty)

The detection logic is simple enough to sketch as a query: any gateway-connected event where the endpoint OS string exactly matches the PoC's hard-coded value and the domain field is empty deserves an analyst's eyes. An empty domain field on a successful connection is an anomaly worth alerting on by itself in most environments.

If you find a hit, the response order matters. Assume the VPN session was a foothold, not the whole attack. Check for RMM tools you didn't deploy, RDP/SMB lateral movement from the gateway segment, and — given the vCenter pivot — audit your hypervisor layer: who touched execInstalledOnly, whether any VMDKs were mounted or copied, and whether Veeam infrastructure was probed for CVE-2023-27532. Then rotate domain credentials with the assumption they were dumped offline, because in-guest EDR would not have caught it. Palo Alto's Cortex Xpanse can enumerate exposed PAN-OS gateways and portals if you have it; if you don't, an external scan of your own ranges gets you most of the same answer.

The cost math nobody wants to do

The editor's question — is your perimeter appliance your highest-risk ransomware entry point? — answers itself in this dataset. One medium-rated-at-first CVE, patched in May, has fed at least three ransomware operations for five months because the patch requires a maintenance window and the exploit requires a GET request. The containment-and-patching cost is a planned outage, a config audit, a log hunt and maybe a credential rotation. The exposure cost is what Unit 42 documented: domain-wide credential theft, hypervisor-level compromise, torched backups and encryption across the estate. Neither The Register nor Unit 42 puts a dollar figure on incidents, and Palo Alto Networks didn't respond to The Register's questions, including how many organizations have been hit — so the true count is unknown. But the asymmetry is not.

Patch to a fixed PAN-OS version or apply the vendor's documented workarounds, run the hunts above, test your management interfaces from the outside, and check your ESXi and Veeam posture while you're in there. The full indicator set and advisory links are in Unit 42's threat brief, with corroborating technical analysis from Rapid7 and Arctic Wolf referenced therein. The drawbridge has been down for five months. Go raise it.