Qilin and INC Ransomware Slip Past MFA Through Unpatched PAN-OS
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.
Two ransomware crews are walking in through the front door of Palo Alto Networks firewalls. In an update to its threat brief on Oct. 19 and 20, Unit 42 says the groups it tracks as Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are abusing CVE-2026-0257, a GlobalProtect authentication bypass, to get VPN sessions that skip multi-factor authentication. The Hacker News reported the update. The bug was patched in May, so the victims are firewalls that never got the fix or the workaround.
For defenders
Affected: PAN-OS GlobalProtect portals and gateways with authentication override cookies enabled (portal “generate” or “accept”, gateway “accept”) plus a specific certificate setup, according to Palo Alto’s advisory (published May 13, updated June 3). Prisma Access is affected; Cloud NGFW and Panorama are not.
Fixed: PAN-OS 12.1.4-h6 / 12.1.7; 11.2.4-h17 / 11.2.7-h14 / 11.2.10-h7 / 11.2.12; 11.1.4-h33 / 11.1.6-h32 / 11.1.7-h6 / 11.1.10-h25 / 11.1.13-h5 / 11.1.15; 10.2.7-h34 / 10.2.10-h36 / 10.2.13-h21 / 10.2.16-h7 / 10.2.18-h6. Pick the build at or above your maintenance train. Prisma Access fixes (11.2.7-h13, 10.2.10-h36) are rolling out on Palo Alto’s schedule.
Severity: CVSS 4.0 base 7.8 (High) per the vendor, which marks urgency as “highest.” Other outlets cite a higher NVD rating; we didn’t confirm it.
Status: exploitation KNOWN (vendor advisory, Unit 42, CISA KEV listing on May 13 per Unit 42). Unit 42 says a public PoC appeared May 29. Arctic Wolf tied intrusions to Qilin in July, and ReliaQuest has linked Qilin and Settra ransomware to the flaw, per The Hacker News.
Post-access, per Unit 42: RMM tools for recon (T1219 (Remote Access Tools)), lateral movement over RDP and SMB (T1021 (Remote Services)), credential theft and exfiltration, then ransomware (T1486 (Data Encrypted for Impact)). In one case the actors pivoted to vCenter, changed the ESXi execInstalledOnly setting, and dumped credentials offline from a domain controller’s VMDK (T1003 (OS Credential Dumping)), which sidesteps in-guest EDR. Some intrusions also hit Veeam via CVE-2023-27532. Initial access maps to T1133 (External Remote Services) (External Remote Services).
23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47Host names: WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT
MACs: aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55
PoC defaults: endpoint OS “Microsoft Windows 10 Pro 64-bit” with an empty source_user_info.domainWhat it means for you
Many companies use a VPN (a secure tunnel into the office network) and protect it with a second login step, like a code on your phone. This flaw lets attackers open that tunnel without passing the second step, on some Palo Alto firewalls that haven’t been updated. Once inside, the groups behind it steal data and lock up systems for ransom. If you’re an employee, you don’t need to do anything yourself. If you run a small business with a Palo Alto firewall, or pay someone who manages one, ask whether it has been patched since May.
Do this now
- Upgrade PAN-OS to a fixed build. If you can’t yet, give the auth-override cookies their own dedicated certificate or turn auth override off on the portal and gateway, as the advisory describes.
- Search GlobalProtect logs back to May for the IPs, host names, MACs and PoC client values above. Unit 42 says to treat any matching successful gateway-connected event as an incident.
- Test from outside your network whether the management interface answers on ports 4443 or 3879, which Unit 42 found exposed in some cases, and lock it down with Interface Management profiles.
- If a VPN hit turns up, check vCenter and ESXi for setting changes and patch Veeam for CVE-2023-27532.