Hackers Exploiting Palo Alto\u2019s PAN-OS Vulnerability to Deploy Qilin Ransomware
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Threat actors are actively exploiting a critical authentication bypass flaw in Palo Alto Networks firewalls to breach corporate networks and deploy Qilin ransomware, according to new research from Arctic Wolf Labs.<\/p>\n
The security firm investigated multiple intrusions throughout June 2026, all tracing back to the same vulnerability as the initial point of entry.<\/p>\n
The flaw, tracked as CVE-2026-0257 (CVSS 7.8)<\/a>, affects the GlobalProtect portal and gateway in PAN-OS. It becomes exploitable when authentication override cookies are enabled alongside specific certificate configurations, allowing unauthenticated attackers to bypass login controls entirely and establish legitimate-looking VPN sessions.<\/p>\n Affected versions include PAN-OS 12.1, 11.2, 11.1, and 10.2 (prior to specific patched builds), along with certain Prisma Access releases. Palo Alto Networks has confirmed limited active exploitation in the wild.<\/p>\n In the intrusions Arctic Wolf reviewed, attackers used compromised VPN sessions to gain direct, interactive access to victim networks \u2014 completely skipping perimeter authentication.<\/p>\n Once inside, attackers followed a fast-moving playbook:<\/p>\n Notably, several attacks originated from systems self-identifying with the hostname \u201ckali,\u201d and overlapping IP addresses appeared in both the initial exploitation and later VPN sessions, suggesting shared infrastructure or tooling among Qilin affiliates.<\/p>\n While the entry point and core techniques remained stable, post-exploitation behavior varied significantly. Some intrusions moved straight to encryption with minimal dwell time, while others involved extensive reconnaissance, credential harvesting at scale, and data theft via Rclone to MEGA cloud storage before ransomware deployment.<\/p>\n This variation is typical of ransomware-as-a-service (RaaS) operations<\/a>, where different affiliates use shared tools but apply their own strategies.<\/p>\n Before triggering encryption, attackers routinely disabled Microsoft Defender\u2019s real-time protection and wiped Windows Event Logs using a PowerShell script that clears every log channel on the system, not just Security or System logs, making forensic recovery far harder.<\/p>\n The ransomware payload itself, consistently named Arctic Wolf recommends immediate action:<\/p>\n Arctic Wolf assesses with moderate confidence<\/a> that exploitation of this vulnerability leading to Qilin ransomware deployment is ongoing, driven by widespread scanning activity and the RaaS model\u2019s tendency to distribute working exploits across multiple affiliates.<\/p>\n The Privilege Paths Attackers See, That You Don\u2019t: BeyondTrust Pathfinder Platform do it for You -> Get Free Identity Security Assessment<\/a><\/strong><\/p>\n The post Hackers Exploiting Palo Alto\u2019s PAN-OS Vulnerability to Deploy Qilin Ransomware<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nPAN-OS Vulnerability Exploited<\/strong><\/h2>\n
\n
win.exe<\/code>, was staged in C:PerfLogs<\/code>, a default Windows directory rarely monitored by security tools. Execution required a password parameter, complicating sandbox analysis.<\/p>\nTactical Security Recommendations<\/strong><\/h2>\n
\n