PAN-OS Flaw Fuels Qilin and Inc Ransomware Attacks
A Firewall Bug Becomes a Ransomware Tool
A flaw in Palo Alto Networks enterprise firewalls has become a full-fledged ransomware tool. It lets attackers enter protected networks without a password. Unit 42 confirmed that the Qilin and Inc groups exploit the PAN-OS bug to bypass authentication and then move through corporate infrastructure.
About CVE-2026-0257
The PAN-OS GlobalProtect vulnerability, tracked as CVE-2026-0257, scores 7.8 on CVSS 4.0. It affects the GlobalProtect portal and gateway, which employees use to connect to work networks over VPN.
In certain configurations, attackers can skip the authentication check and open a VPN connection. From there, they reach the internal network, even past multi-factor authentication.
Who Is Behind the Attacks
Researchers tie the campaigns to Spikey Scorpius, known as Qilin, and to Tarnished Scorpius, which uses the Inc ransomware. Public reports also point to operators of Settra.
Unit 42 has investigated such attacks since early June 2026. Victims include healthcare facilities, banks, industrial firms, and government bodies, among other sectors.
What Happens After the Break-In
Once inside, the ransomware crews study the internal network with legitimate remote administration tools. Next, they move between machines over RDP and SMB. They also prepare tools to steal credentials and pull out data. The final step may be to deploy the encryptor.
A Dangerous Virtual Infrastructure Case
Unit 42 found an especially risky scenario in an attack on virtual infrastructure. After entering through the VPN gateway, the intruders reached a VMware vCenter management server. They disabled the execInstalledOnly protection on the ESXi hypervisors.
A special program then pulled credentials straight from the VMDK virtual disk of a domain controller. That method sidestepped threat detection tools inside the guest system.
A Second Flaw in Backup Software
The attackers also paired the PAN-OS entry point with CVE-2023-27532 in Veeam backup infrastructure. That flaw scores 7.5 on CVSS 3.1. The combination widens what attackers can do once they breach the network perimeter.
Unit 42 does not disclose how many organizations suffered or how many ransomware deployments it confirmed.
Patches and Mitigation
The problem surfaced in May, and fixes are now available for supported PAN-OS versions. Vulnerable setups use GlobalProtect with cookie-based re-authentication.
Palo Alto Networks recommends these steps:
- Install the updates.
- Disable the risky feature, or use a separate certificate.
- Review VPN connection logs.
- Check whether management interfaces are reachable on ports 4443 and 3879.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
