Qilin, INC and Settra ransomware crews exploit PAN-OS GlobalProtect bug CVE-2026-0257 since June, pivoting to ESXi
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…