CriticalCVE-2026-0257CVE-2023-27532 5 Hunt LeadsIOCsRemote AttackerQilinINC RansomQilinINC RansomThe Hacker News
Qilin and INC Ransomware Slip Past MFA Through Unpatched PAN-OS
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.