Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity checking, which allows remote, unauthenticated attackers to bypass security restrictions and establish an unauthorized VPN connection. The vulnerabilities affect the GlobalProtect portal and gateway of PAN’s physical and virtual firewalls running PAN-OS software, as well as Prisma Access. Palo Alto Networks initially rated the flaw medium severity when it disclosed it on May 13 and, on May 29, updated its advisory to say it had “become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.” By then, Rapid7 had reported that attackers targeted the local administrator account on its customers’ devices starting May 17, and that some of them reached internal networks in a second wave on May 21. On October 19, Unit 42 updated its threat brief on the flaw, naming Qilin and Inc among the ransomware operators exploiting it. The company’s incident responders have been investigating intrusions linked to the vulnerability since early June. “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” wrote Andy Piazza, Senior Director of Threat Intelligence at Palo Alto Networks Unit 42. Once inside, the attackers use legitimate IT management tools to explore the network, spread to other machines, and bring in tools to steal passwords and data before deploying ransomware. In one case Unit 42 investigated, the attackers went from the compromised VPN gateway to the vCenter management appliance, turned off security controls on the ESXi hypervisors, and ran a custom tool against a domain controller’s virtual disk to extract credentials offline. “This tactic bypasses in-guest endpoint detection and response (EDR) and security controls, representing a highly sophisticated method for obtaining domain-wide credentials.” “We have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact,” added Piazza. Intruders posing as remote employees ReliaQuest also tracked exploitation by several threat groups, including the Qilin and Settra ransomware operations, and found Cobalt Strike, BloodHound and SharpHound in the related activity. “Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway,” the company warned. Its analysts expect the attacks to go on, assessing that exploitation is “highly likely to continue over the next three months” as ransomware groups and initial access brokers look for unpatched systems. ReliaQuest advises organizations to upgrade affected deployments without delay, disable authentication override cookies where they are not needed, end all active GlobalProtect sessions after patching, and look into unexpected connections, including sessions with hostnames such as “kali.” “Patching alone may not remove access established before remediation,” the researchers cautioned. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!