Cybersecurity researchers have identified that threat actors are actively exploiting a critical vulnerability in Palo Alto Networks’ PAN-OS software to deploy Qilin ransomware within corporate networks. This flaw, designated as CVE-2026-0257 with a CVSS score of 7.8, affects the GlobalProtect portal and gateway components of PAN-OS. When authentication override cookies are enabled alongside specific certificate configurations, unauthenticated attackers can bypass login controls entirely, establishing unauthorized VPN sessions.
Arctic Wolf Labs investigated multiple intrusions in June 2026, all tracing back to this vulnerability as the initial point of entry. The affected PAN-OS versions include 12.1, 11.2, 11.1, and 10.2, prior to specific patched builds, as well as certain Prisma Access releases. Palo Alto Networks has confirmed limited active exploitation in the wild.
Exploitation Tactics and Techniques
Once inside the network, attackers employed a series of tactics to maintain access and escalate their privileges:
- Persistence Mechanisms: Attackers established persistence by creating registry Run keys with a distinctive naming pattern—an asterisk followed by six random lowercase letters.
- Remote Access Tools: Tools such as AnyDesk, Ngrok, and LogMeIn were deployed to ensure redundant connectivity.
- Credential Harvesting: Credentials were extracted from LSASS memory using rundll32.exe and comsvcs.dll, with outputs disguised as “.odt” files to evade detection.
- Active Directory Compromise: The entire Active Directory database was extracted via ntdsutil.exe, granting domain-wide credential access.
- Lateral Movement: PsExec and administrative shares (C$) were utilized for movement across the network.
Notably, several attacks originated from systems self-identifying with the hostname “kali,” and overlapping IP addresses appeared in both the initial exploitation and subsequent VPN sessions, suggesting shared infrastructure or tooling among Qilin affiliates.
Variability in Post-Exploitation Behavior
While the initial access and core techniques remained consistent, post-exploitation behaviors varied significantly among different intrusions. Some attacks proceeded directly to encryption with minimal dwell time, while others involved extensive reconnaissance, large-scale credential harvesting, and data exfiltration to cloud storage services like MEGA using tools such as Rclone, Proton Drive, and FileZilla before deploying the ransomware.
This variability aligns with the ransomware-as-a-service (RaaS) model, where multiple affiliates utilize shared tools but apply their own strategies. Before initiating encryption, attackers commonly disabled Microsoft Defender’s real-time protection and cleared Windows Event Logs using PowerShell scripts that wiped all log channels, complicating forensic analysis.
The ransomware payload, consistently named `win.exe`, was staged in the `C:\PerfLogs\` directory—a default Windows folder rarely monitored by security tools. Execution required a password parameter, adding complexity to sandbox analysis.
Organizations utilizing Palo Alto Networks’ PAN-OS should prioritize applying the latest patches to mitigate this vulnerability. Additionally, implementing robust monitoring of VPN sessions, scrutinizing unusual registry changes, and maintaining comprehensive logging practices are essential to detect and prevent such sophisticated attacks. The exploitation of CVE-2026-0257 underscores the critical importance of timely vulnerability management and the need for a proactive security posture to defend against evolving ransomware threats.
