By Thomas Anderson in Security News — 20 Oct 2026

Qilin and INC Ransomware Have Spent Months Inside a Patched Palo Alto GlobalProtect Flaw — Unit 42 Says Attackers Pivot From the VPN Gateway Straight to vCenter and Virtual Disks

Palo Alto Networks' Unit 42 says ransomware operators — including Qilin (Spikey Scorpius) and INC (Tarnished Scorpius), with ReliaQuest also tracking the Settra operation — are exploiting CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS firewalls and Prisma Access. The flaw, fixed in May, stems from the firewalls trusting cookies without detailed validation and integrity checking, letting unauthenticated attackers circumvent security controls — including MFA — and establish unauthorized VPN connections. Unit 42's incident responders have been working intrusions tied to the vulnerability since early June, across healthcare, education, government, energy, manufacturing, financial services, and a dozen other sectors.

The timeline matters because the patch has existed for five months. Palo Alto disclosed the flaw on May 13 and initially rated it medium severity; on May 29 it updated its advisory to say it had become aware of "limited exploit attempts on unpatched PAN-OS devices without mitigations applied," and CISA added it to the Known Exploited Vulnerabilities catalog. Rapid7 observed attackers targeting the local administrator account on its customers' devices from May 17, with a second wave reaching internal networks on May 21. Arctic Wolf flagged Qilin's use of the flaw as far back as July. Once inside, the actors run internal reconnaissance with dual-use RMM tools — Cobalt Strike, BloodHound and SharpHound per ReliaQuest — move laterally over RDP and SMB, and stage credential harvesting, data exfiltration, and ransomware deployment.

The most significant tactical evolution, per Unit 42, is a direct pivot to the virtualization layer. In one investigated case the attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled security controls on ESXi hypervisors (execInstalledOnly), and ran a custom tool to dump credentials offline from a domain controller's virtual disk (VMDK) — bypassing in-guest EDR entirely and harvesting domain-wide credentials. The actors also chain the initial access with exploits against Veeam backup infrastructure (CVE-2023-27532) to maximize damage. ReliaQuest warns that because the access originates through the organization's own VPN, malicious activity "can resemble legitimate remote work" and may go undetected until credential theft, lateral movement, or ransomware is already underway — and assesses exploitation as "highly likely to continue over the next three months" as ransomware groups and initial access brokers sweep for unpatched gateways.

Unit 42's published indicators make hunting concrete: exploit-attempt source IPs from the pre-PoC window (23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119/120/125, and others), suspicious client host IDs such as kali, WINDOWS-LAPTOP-001, and GP-CLIENT, and hard-coded values from the public PoC — a "Microsoft Windows 10 Pro 64-bit" endpoint OS string with an empty domain — all of which can be searched directly in GlobalProtect logs.

What Should You Do?

Verify the patch, then evict — confirm every GlobalProtect portal and gateway runs a fixed PAN-OS version, terminate all active GlobalProtect sessions after patching, and review successful gateway-connected events. ReliaQuest is blunt: patching alone may not remove access established before remediation.
Hunt the published indicators — search GlobalProtect logs for the Unit 42 IP list and for suspicious device metadata (host IDs like kali, WINDOWS-LAPTOP-001, GP-CLIENT; the PoC's Windows 10 Pro 64-bit with empty domain) and treat any successful match as an incident.
Disable authentication override cookies where they are not needed, and stop trusting authentication events alone — monitor session device metadata and login cadence for anomalies that betray forged cookies.
Extend monitoring to the virtualization layer — alert on vCenter access, ESXi security-setting changes, and VMDK file access, and patch Veeam backup infrastructure (CVE-2023-27532) alongside, because that is where this crew converts VPN access into domain-wide credentials and backup destruction.

The WAF Angle

The bypass means the VPN itself forged the attacker's ticket — MFA downstream never engages, because the session cookie was never legitimately issued. That is the same lesson as the PAN-OS management-interface zero-day we covered on October 14 — a different flaw in the same product — and of the FortiBleed credential campaigns: edge authentication devices are initial-access infrastructure, and patch velocity on them is the control that separates victims from everyone else. Web teams should treat GlobalProtect session logs as first-class security telemetry — host IDs, device names, and connection cadence are the anomalies that expose sessions that never should have existed.

Qilin and INC Ransomware Have Spent Months Inside a Patched Palo Alto GlobalProtect Flaw — Unit 42 Says Attackers Pivot From the VPN Gateway Straight to vCenter and Virtual Disks