Ransomware gangs including Qilin and Inc are breaking into corporate networks through a flaw in Palo Alto Networks' GlobalProtect VPN that the company fixed in May, its Unit 42 threat research team said, as The Register reported Tuesday. Because intruders may have gotten in before fixes were applied, the findings shift the question for many organizations from whether they patched to whether someone is already inside.
What Happened
The flaw, CVE-2026-0257, lets an attacker get around authentication on GlobalProtect portals and gateways, the systems that admit remote employees to a corporate network over a virtual private network (VPN), and open an unauthorized VPN session. According to Palo Alto's security advisory, it affects setups that use a convenience feature called authentication override cookies, rates high severity at 7.8 out of 10 and carries the company's "highest" suggested urgency. Palo Alto published the advisory and fixes May 13. The Register reported that the company initially rated the bug medium severity and that the security firm Rapid7 saw successful exploitation in customer networks dating to at least May 17. CISA's Known Exploited Vulnerabilities catalog lists the flaw as added May 29 and now marks it as known to be used in ransomware campaigns.
Unit 42 is Palo Alto's own research arm, so its findings are vendor research about the company's product. In a threat brief updated Oct. 19 and 20, it said operators of Qilin, which it tracks as Spikey Scorpius, and Inc, tracked as Tarnished Scorpius, are exploiting the bug. It also cited public reporting by the security firm ReliaQuest that ties Settra ransomware operators to the activity, without saying it had confirmed that link.
Unit 42 described a consistent pattern: attackers sidestep multifactor authentication to open a VPN session, scout the network with remote-management tools, spread through Remote Desktop and Windows file-sharing connections, then stage tools to steal credentials, copy data and deploy ransomware. In one case, intruders moved from the VPN gateway to a VMware vCenter appliance, the console that manages a company's virtual servers, disabled a security control on the underlying ESXi hosts and copied passwords offline from a domain controller's virtual disk. That route bypasses endpoint detection software running inside the machines. Some attackers also paired the VPN access with an exploit for CVE-2023-27532, a flaw in Veeam backup servers.
Unit 42 said its investigations since early June span 11 sectors, including education, financial services, healthcare, government, manufacturing, legal services, utilities and retail. Andy Piazza, senior director of threat intelligence at Unit 42, told The Register that attackers use the flaw to "gain an initial foothold into corporate networks." Palo Alto did not tell The Register how many organizations were hit.
Why It Matters
This is a different flaw from the Palo Alto firewall bug that CISA ordered federal agencies to fix last week, which affected the firewall's management interface, The Primary Wire reported, citing CISA. The common thread is that devices at the network edge remain a favored way in, and that a five-month-old fix offers little comfort if attackers arrived first.
Unit 42 published nine IP addresses, five device names and values linked to public exploit code for teams to check against GlobalProtect logs, and it urged incident response for any successful connection that matches. It also found customers who had unknowingly exposed firewall management interfaces on ports 4443 and 3879 through GlobalProtect settings. ReliaQuest researchers cautioned that patching alone may not remove access established before remediation, Help Net Security reported.
For boards, the practical questions are whether GlobalProtect was exposed and unpatched at any point after mid-May, whether the team has searched for the published indicators, and whether changes to virtualization servers are monitored.
What to Watch
Cybersecurity Dive reported that Arctic Wolf investigated multiple Qilin attacks in June that used the flaw, and Help Net Security said ReliaQuest assesses exploitation is highly likely to continue over the next three months. Watch for victim disclosures, any count from Palo Alto, and whether more gangs adopt the public exploit. The same week, U.S. and European agencies warned that the SafePay ransomware group also relies on VPN access and older firewall flaws, The Primary Wire reported.
