Qilin and Inc Target Industries With Ransomware Via Active Palo Alto VPN Auth Flaw
Threat actors use a high-severity authentication bypass in PAN-OS to establish unauthorized VPN sessions and deploy ransomware across multiple industries.
Key points
- Unit 42 investigates active exploitation of CVE-2026-0257 by Qilin and Inc since early June.
- The flaw allows attackers to bypass multi-factor authentication on GlobalProtect portals.
- Palo Alto Networks patched the issue on May 13, but exploitation continues in the wild.
Ransomware operators are gaining unauthorized access to corporate networks by exploiting a high-severity authentication bypass in Palo Alto Networks' PAN-OS. This flaw allows attackers to circumvent multi-factor authentication controls and establish VPN sessions without proper credentials. Security teams are responding to a surge in compromises driven by this specific vulnerability.
In plain English
The attack relies on a weakness in how the firewall operating system handles login requests. Attackers do not need to steal passwords or defeat two-factor authentication mechanisms. Instead, they exploit the bug to trick the system into granting them a valid connection. This gives them immediate access to the internal network as if they were legitimate users.
View the original post on X
The background
Palo Alto Networks disclosed and patched the vulnerability, identified as CVE-2026-0257, on May 13. The vendor initially rated the severity as medium, stating it had not observed malicious exploitation. However, Rapid7 researchers reported successful attacks in customer environments dating back to May 17 by the end of that month.
Unit 42, the incident response arm of Palo Alto Networks, confirmed on Monday that ransomware groups including Qilin and Inc continue to exploit the CVE. Andy Piazza, a senior director of threat intelligence at Unit 42, noted that attackers use this entry point to gain an initial foothold. They then bypass MFA to establish persistent VPN sessions.
What changes now
Following initial access, the criminals move laterally across networks using Remote Desktop Protocol and Server Message Block. They deploy additional malware designed for credential harvesting and data theft before ultimately installing ransomware. Unit 42 has identified victims across numerous sectors, including finance, healthcare, manufacturing, education, government, and energy.
The scope of the impact remains broad, with infections reported in hospitality, high tech, transportation, logistics, utilities, and wholesale retail. Professional and legal services firms have also been targeted. Palo Alto Networks did not respond to inquiries regarding the total number of infected organizations or further details about the ongoing campaigns.
What made it possible
This incident highlights the risks of relying solely on perimeter authentication when underlying platform flaws exist. Teams usually monitor for unauthorized VPN session establishments that lack corresponding successful MFA logs. Check whether network traffic analysis tools can detect anomalous connection patterns from known threat actor infrastructure. Ensure that segmentation limits lateral movement even if an initial foothold is gained through a bypassed gateway.
Background: Ransomware
Ransomware is malicious software that encrypts your files, making them unreadable until you pay a fee. It often arrives via email attachments or malicious downloads. You can prevent it by keeping backups offline, updating software, and verifying links before clicking.
Read the full guide: Ransomware Explained: How File Locking Works and What to Do
What to do and how to stay safe: Palo Alto Networks
- Verify that all PAN-OS instances are updated to the version released after May 13 to address CVE-2026-0257.
- Review GlobalProtect portal logs for VPN sessions that were established without successful multi-factor authentication events.
- Monitor for lateral movement indicators such as unusual Remote Desktop Protocol or Server Message Block traffic from gateway endpoints.
- Isolate affected systems immediately if credential harvesting malware or ransomware deployment is detected within the network.
Step-by-step guide: Implement Firewalls: A Step-by-Step Guide for Network Security
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-0257?
It is a high-severity authentication bypass vulnerability in Palo Alto Networks' PAN-OS that affects GlobalProtect portals and gateways.
Which ransomware groups are exploiting this flaw?
Unit 42 has identified Qilin and Inc as active exploiters of this vulnerability since early June.
Did Palo Alto Networks know about the attacks before patching?
The vendor patched the bug on May 13 but initially stated it had not observed malicious exploitation, a stance changed by later findings.
