Qilin and Inc exploit PAN-OS CVE-2026-0257 to bypass MFA and hit finance sector

1. Executive summary

Ransomware crews tracked as Qilin and Inc are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways, to establish unauthorised VPN sessions that sidestep MFA and give them a foothold inside corporate networks. Palo Alto's Unit 42 has investigated the activity since early June 2026 and names financial services among the affected sectors. CVE-2026-0257 carries a CVSS score of 7.8 (HIGH), is listed in CISA KEV with an addition date of 2026-05-29, and has an EPSS score of 97%, so exploitation is both confirmed in the wild and near-certain to be attempted against any exposed portal. The same campaigns chain a second KEV entry, CVE-2023-27532 in Veeam backup infrastructure (CVSS 7.5 HIGH, KEV added 2023-08-22, EPSS 81%), which raises the impact for any EMEA firm running GlobalProtect at the edge and Veeam in the backup tier.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-0257 is an authentication bypass in PAN-OS GlobalProtect portals and gateways. Successful exploitation lets an attacker establish an unauthorised VPN connection without completing authentication, which is why MFA does not stop it: the session is created before MFA is enforced. Palo Alto disclosed and patched the flaw on 13 May 2026 and initially rated it medium severity, stating it was aware of exploitation attempts but had not observed malicious exploitation. Rapid7 reported successful exploitation across multiple customer environments dating back to at least 17 May, and SecurityWeek reports exploitation began four days after public disclosure. The verified severity is CVSS 7.8 HIGH, and the CWE is recorded as CWE-565 (reliance on cookies or hidden fields for security); the source describes the flaw only as an authentication bypass, so the CWE classification is the more specific record.

Confirmed attack chain, from Unit 42, Arctic Wolf and ReliaQuest reporting:

1. Initial access: the actor exploits CVE-2026-0257 against an internet-facing GlobalProtect portal or gateway and establishes an unauthorised VPN session, bypassing MFA.
2. Internal reconnaissance and lateral movement: the actor moves across the network using Remote Desktop Protocol and Server Message Block.
3. Tooling: Cobalt Strike, BloodHound and SharpHound have been observed in these intrusions, consistent with credential mapping and hands-on-keyboard operation.
4. Credential harvesting and data theft: additional malware is dropped for credential harvesting and data theft before ransomware deployment.
5. Virtualisation pivot: in one case Unit 42 documented, the actor moved from the compromised VPN gateway to a vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors, and used a custom tool to perform offline credential dumping directly against a domain controller's VMDK. This bypasses in-guest EDR because the disk is read outside the running guest.
6. Chaining: Unit 42 observed the PAN-OS exploit chained with CVE-2023-27532, the Veeam backup infrastructure flaw (CVSS 7.5 HIGH, KEV added 2023-08-22, EPSS 81%), to extend access.
7. Impact: ransomware deployment. Arctic Wolf's June investigations ranged from rapid encryption to double extortion, which it attributes to Qilin affiliate groups operating under a ransomware-as-a-service model.

Sectors named by Unit 42 include education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

Attribution caveats. Qilin and Inc are named by Unit 42, with Palo Alto tracking them as Spikey Scorpius and Tarnished Scorpius respectively. Settra is named only by ReliaQuest. None of the three has a MITRE ATT&CK profile in the verified data, so the attribution to specific ransomware brands is unconfirmed at the actor-identity level. The exploitation activity itself is corroborated across Unit 42, Rapid7, Arctic Wolf and ReliaQuest. The virtualisation-layer technique and the execInstalledOnly detail rest on Unit 42's account, single-sourced; verify before relying on it for detection design. ReliaQuest's warning that the activity originates from internal VPN addresses and may resemble legitimate remote access is also single-sourced.

4. Mitigation & containment

P1, within 24 hours:

• Patch PAN-OS to the fixed release for CVE-2026-0257. The source confirms a fix was published on 13 May 2026 but does not name the version; obtain the fixed version from the Palo Alto advisory before scheduling. Until patched, restrict GlobalProtect portal and gateway exposure to known source ranges or take the portal offline if it cannot be patched.
• Hunt for unauthorised VPN sessions. Because the sessions appear as legitimate remote access, review GlobalProtect authentication and session logs for sessions that did not complete MFA, for source addresses outside expected geographies, and for sessions that began shortly after 17 May 2026. ReliaQuest's observation that the activity looks like normal remote access is the reason this step cannot wait for an alert.
• Patch or isolate Veeam backup infrastructure against CVE-2023-27532 (KEV since 2023-08-22). Confirm the backup tier is not reachable from the VPN address pool.
• Check ESXi hosts for execInstalledOnly being disabled. Re-enable it and record the change. Review vCenter for logins from VPN address ranges.

P2, within 72 hours:

• Review domain controller VMDK access. Any offline read of a DC virtual disk outside normal backup windows should be treated as credential compromise; rotate krbtgt and privileged account credentials if found.
• Hunt for Cobalt Strike, BloodHound and SharpHound execution. BloodHound and SharpHound generate distinctive LDAP and collection telemetry; Cobalt Strike beacons show periodic HTTPS to uncommon destinations.
• Restrict RDP and SMB between network segments. The lateral movement in these intrusions used both, so segment boundaries that block workstation-to-workstation RDP and SMB remove the path.

P3, within 7 days:

• Add CVE-2026-0257 and CVE-2023-27532 to the emergency patch SLA for edge and backup products, with a defined maximum exposure window.
• Test the DORA Art. 19 reporting process against a scenario where the intrusion is confirmed only after ransomware detonation, since the VPN session may not generate an alert.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IP addresses) are present in the source material. The sources describe behaviours and tooling but publish no machine-pivotable values. Unit 42's IOC list is referenced by The Register but not reproduced here; obtain it directly from Unit 42 before threat hunting.

Behavioural indicators:

6. Detection

The sources give no file artefacts, command lines, mutexes, registry keys or ransom-note text, so a YARA rule built on them would only match reporting about the threat. No YARA rule is emitted. The Sigma rule below targets the behavioural pattern the sources describe: a GlobalProtect VPN session that succeeds without MFA.

title: GlobalProtect VPN Session Established Without MFA
id: 8f3c2a91-4b7e-4d2a-9c1f-6e5a0b3d7c48
status: experimental
description: Detects a successful GlobalProtect VPN session where no MFA challenge was completed, consistent with CVE-2026-0257 authentication bypass.
author: Adverse Trace
date: 2026/10/20
references:

  - https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
  - https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/
logsource:
  product: paloaltonetworks
  service: globalprotect
detection:
  selection_success:
    event_type: 'gateway-auth-success'
  selection_no_mfa:
    mfa_completed: 'false'
  condition: selection_success and selection_no_mfa
falsepositives:

  - Service accounts or device tunnels configured without MFA
level: high

Field names in the logsource block are placeholders; map them to the actual GlobalProtect log schema in use before deployment. The detection logic (successful session with no MFA completion) is what matters.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV)

7. Sources

• The Register, "Palo Alto's firewall OS has been under attack from multiple ransomware groups since June", https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226, 2026-10-20.
• Cybersecurity Dive, "Ransomware groups expand targeting of Palo Alto Networks vulnerability", https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/, 2026-10-20.
• The Hacker News, "Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA", https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html, 2026-10-20.
• The Hacker News, "Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access", https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html, 2026-07.
• The Hacker News, "PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation", https://thehackernews.com/2026/05/pan-os-globalprotect-authentication.html, 2026-05.
• SecurityWeek, "Recent Palo Alto Networks Vulnerability Exploited for Weeks", https://www.securityweek.com/recent-palo-alto-networks-vulnerability-exploited-for-weeks/, 2026.
• DataBreaches.net, "Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA", https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/, 2026-10-20.

8. Adverse Trace position

CVE-2026-0257 is a CVSS 7.8 HIGH authentication bypass, in CISA KEV since 2026-05-29, with an EPSS score of 97%. Those are the figures we assess against, not the medium rating Palo Alto applied at disclosure. The exploitation is corroborated across four independent reporting streams, but the actor attribution to Qilin, Inc and Settra is unconfirmed: none has a MITRE ATT&CK profile, and the virtualisation-layer technique rests on a single Unit 42 case. Clients running GlobalProtect at the edge with Veeam in the backup tier carry the highest exposure because the two KEV entries chain. We will obtain the fixed PAN-OS version and Unit 42's IOC list, reissue this advisory with atomic indicators when they are available, and contact clients with internet-facing GlobalProtect portals to confirm patch status and VPN session review by 2026-10-22.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.