Qilin Ransomware Operators Exploit CVE-2026-0257 Palo Alto GlobalProtect Vulnerability for VPN Compromise

Key Findings

• Arctic Wolf Labs identified multiple June 2026 intrusions where attackers exploited CVE-2026-0257 to deliver Qilin ransomware across victim domains
• CVE-2026-0257 is an authentication bypass in Palo Alto Networks GlobalProtect affecting PAN-OS versions 10.2, 11.1, 11.2, and 12.1, plus some Prisma Access deployments
• Attackers gained VPN access without credentials, then moved laterally to steal credentials and deploy ransomware, with some cases involving double extortion
• Multiple Qilin affiliates appear responsible based on varying post-exploitation tactics, suggesting continued RaaS distribution
• Palo Alto Networks confirmed limited active exploitation; patches released May 13, 2026

Background

Qilin ransomware operates as a ransomware-as-a-service platform active since at least 2022. The operation recruits affiliates through underground forums and employs a double-extortion model combining encryption with data theft. The June 2026 wave of intrusions marked a significant shift in initial access methodology, with the perimeter vulnerability becoming the decisive attack vector across multiple unrelated victims.

The Vulnerability

CVE-2026-0257 carries a CVSS score of 7.8 and enables unauthenticated attackers to establish VPN sessions through the GlobalProtect portal and gateway. The flaw affects PAN-OS 10.2, 11.1, 11.2, and 12.1 branches along with specific Prisma Access versions. Cloud NGFW and Panorama deployments are not affected. Palo Alto Networks released patches on May 13, 2026, but widespread adoption lagged significantly.

Attack Pattern and Execution

All observed intrusions followed a consistent initial phase but diverged afterward. Attackers established GlobalProtect VPN sessions from systems identifying as Kali Linux hosts, then secured persistence through registry Run keys, scheduled tasks, and remote access tools including AnyDesk, Ngrok, and LogMeIn. They dumped LSASS memory and extracted the Active Directory database to enable lateral movement via PsExec and RDP with stolen credentials.

Post-compromise activity split into two categories. Rapid encryption operations moved directly to ransomware deployment, typically staging win.exe in C:\PerfLogs before execution. Other campaigns conducted extensive reconnaissance, deployed additional tooling, and exfiltrated data to cloud storage using Rclone, ProtonDrive, FileZilla, and MEGA before triggering encryption. Some operators disabled Microsoft Defender and scanned networks with SoftPerfect Network Scanner and NetExec.

Attribution and Actor Profile

The variation in post-compromise tradecraft strongly indicates multiple Qilin affiliates rather than a single coordinated group. Overlapping source IPs and shared staging paths suggest common infrastructure or tooling distribution, consistent with RaaS operational models. No arrests have been reported, and attribution to specific individuals remains open.

Impact and Scale

Each compromise reached domain-wide encryption. Attackers systematically disabled defenses, stole domain password hashes, and in double-extortion cases targeted backup infrastructure to prevent recovery. Arctic Wolf assesses with moderate confidence that similar intrusions are ongoing, supported by extensive scanning activity and the RaaS model's incentive to distribute successful exploits among multiple affiliates.

Detection and Mitigation

Organizations should prioritize patching PAN-OS and Prisma Access immediately. Hunt for GlobalProtect VPN sessions from unfamiliar or Kali-identified hosts and monitor for payloads in C:\PerfLogs. Alert on LSASS dumping, NTDS extraction, mass event-log clearing, and large outbound transfers to cloud storage from servers that rarely initiate them. Early detection at initial access or credential theft stages can prevent encryption deployment entirely.

Sources

• https://securityonline.info/qilin-ransomware-cve-2026-0257/
• https://securityaffairs.com/195730/cyber-crime/qilin-ransomware-affiliates-abuse-cve-2026-0257-to-gain-unauthorized-vpn-access.html
• https://cybersecuritynews.com/cve-2026-0257-qilin-ransomware
• https://mallory.ai/stories/019f81cb-1152-792c-adf8-47e5d1738dd3