Qilin and Settra exploit PAN-OS CVE-2026-0257; ThreatsDay roundup of new RATs, stealers, WordPress backdoor and Meta GitHub breach
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, data theft or ransomware deployment. The weekly ThreatsDay bulletin also covers new malware, including the Noir wallet drainer, CikaBika Bot, KGB RAT, BotHelper RAT, Warden Stealer, CastleStealer, an expanded XWorm and the Aoki infostealer, which now targets AI coding assistant credentials. Other items include a self-healing WordPress must-use plugin backdoor using EtherHiding, a Meta GitHub breach via stolen employee credentials affecting about 1,500 people, and vendor defensive updates from Google, Anthropic, Mozilla and Microsoft.
Detalhes técnicos
- CVE-2026-0257 (PAN-OS): exploited by Qilin and Settra. Attackers use authentication override cookies, and sessions with hostnames such as 'kali' were observed.
- Noir (Infoblox): wallet drainer that finds its Cloudflare Pages-hosted pool via DNS TXT records queried over public DoH. It needs no seed phrase, only read permissions and then spending permissions. AI-assisted development is suspected.
- CikaBika Bot (Darktrace): Rust RAT delivered via a malicious LNK and a PDF with an embedded payload. It uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking, with Discord C2 and ngrok exfiltration.
- KGB RAT (Group-IB): Windows RAT sold on underground forums since late 2025 for $150 to $800. It has a built-in crypter, HVNC, credential theft, keylogging, ransomware and harassment features such as screamers and forced BSODs. Version 0.1 was referenced in January 2022.
- BotHelper RAT (Point Wild): .NET RAT with live screen surveillance. A native x64 stager contacts easyllms.xyz and fetches payload.bin. The RAT persists via a scheduled task every 30 minutes, patches AMSI and polls PHP endpoints.
- WordPress must-use plugin (Wordfence): self-healing backdoor using EtherHiding via an Ethereum smart contract. It creates and hides a rogue administrator, harvests admin passwords and spreads to other WordPress installs on the same filesystem.
- XWorm (Netskope): now a surveillance platform with plugins up from 35 to 46. Versions seen since July 2025 are V6.4, V6.5 'XWorm Reborn', V7.2 and V7.4. Plugins include Maps, Microphone, HBrowser and Webcam.
- Warden Stealer (Gen Digital): Rust MaaS infostealer with a loader and crypto clipper. It targets config files of AI assistants and agentic coding tools.
- CastleStealer (Flashpoint): C# stealer, first seen April 2026. New variants bypass Chromium app-bound encryption, allow remote command execution and exfiltrate in small encrypted transmissions.
- Aoki / Aokigahara (Symantec): targets credential and session files of Claude, Codex, Cursor, Codeium and Gemini. Stolen API keys and tokens enable abuse under a developer's identity and access to repositories, cloud and CI/CD.
- Meta GitHub breach: unknown actors used a stolen employee's credentials to access some repositories. About 1,500 people are being notified, mostly US employees. Access has been shut down.
- Russia hybrid warfare (Recorded Future): assessed escalation of hybrid, asymmetric operations across Europe since February 2022.
Remediação
- For PAN-OS, upgrade affected deployments immediately. Disable authentication override cookies where not required, terminate all active GlobalProtect sessions after patching and investigate unexpected connections, including hostnames such as 'kali'. Patching alone may not remove access established before remediation.
- Rotate and protect API keys, OAuth and session tokens used by AI coding tools.
- Microsoft advises inventorying certificate dependencies and testing PKI, HSMs and appliances for post-quantum authentication.
- Google is rolling out Android scam protections, including real-time bank call verification, which has blocked more than 3 million spoofed calls from Banco do Brasil and Itaú Unibanco since June 2026.
Linha do tempo
-
Qilin and Settra exploit PAN-OS CVE-2026-0257; ThreatsDay roundup of new RATs, stealers, WordPress backdoor and Meta GitHub breach
ler a análise desta fonte ocultar
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, data theft or ransomware deployment. The weekly ThreatsDay bulletin also covers new malware, including the Noir wallet drainer, CikaBika Bot, KGB RAT, BotHelper RAT, Warden Stealer, CastleStealer, an expanded XWorm and the Aoki infostealer, which now targets AI coding assistant credentials. Other items include a self-healing WordPress must-use plugin backdoor using EtherHiding, a Meta GitHub breach via stolen employee credentials affecting about 1,500 people, and vendor defensive updates from Google, Anthropic, Mozilla and Microsoft.
Technical Details
- CVE-2026-0257 (PAN-OS): exploited by Qilin and Settra. Attackers use authentication override cookies, and sessions with hostnames such as 'kali' were observed.
- Noir (Infoblox): wallet drainer that finds its Cloudflare Pages-hosted pool via DNS TXT records queried over public DoH. It needs no seed phrase, only read permissions and then spending permissions. AI-assisted development is suspected.
- CikaBika Bot (Darktrace): Rust RAT delivered via a malicious LNK and a PDF with an embedded payload. It uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking, with Discord C2 and ngrok exfiltration.
- KGB RAT (Group-IB): Windows RAT sold on underground forums since late 2025 for $150 to $800. It has a built-in crypter, HVNC, credential theft, keylogging, ransomware and harassment features such as screamers and forced BSODs. Version 0.1 was referenced in January 2022.
- BotHelper RAT (Point Wild): .NET RAT with live screen surveillance. A native x64 stager contacts easyllms.xyz and fetches payload.bin. The RAT persists via a scheduled task every 30 minutes, patches AMSI and polls PHP endpoints.
- WordPress must-use plugin (Wordfence): self-healing backdoor using EtherHiding via an Ethereum smart contract. It creates and hides a rogue administrator, harvests admin passwords and spreads to other WordPress installs on the same filesystem.
- XWorm (Netskope): now a surveillance platform with plugins up from 35 to 46. Versions seen since July 2025 are V6.4, V6.5 'XWorm Reborn', V7.2 and V7.4. Plugins include Maps, Microphone, HBrowser and Webcam.
- Warden Stealer (Gen Digital): Rust MaaS infostealer with a loader and crypto clipper. It targets config files of AI assistants and agentic coding tools.
- CastleStealer (Flashpoint): C# stealer, first seen April 2026. New variants bypass Chromium app-bound encryption, allow remote command execution and exfiltrate in small encrypted transmissions.
- Aoki / Aokigahara (Symantec): targets credential and session files of Claude, Codex, Cursor, Codeium and Gemini. Stolen API keys and tokens enable abuse under a developer's identity and access to repositories, cloud and CI/CD.
- Meta GitHub breach: unknown actors used a stolen employee's credentials to access some repositories. About 1,500 people are being notified, mostly US employees. Access has been shut down.
- Russia hybrid warfare (Recorded Future): assessed escalation of hybrid, asymmetric operations across Europe since February 2022.
Remediation
- For PAN-OS, upgrade affected deployments immediately. Disable authentication override cookies where not required, terminate all active GlobalProtect sessions after patching and investigate unexpected connections, including hostnames such as 'kali'. Patching alone may not remove access established before remediation.
- Rotate and protect API keys, OAuth and session tokens used by AI coding tools.
- Microsoft advises inventorying certificate dependencies and testing PKI, HSMs and appliances for post-quantum authentication.
- Google is rolling out Android scam protections, including real-time bank call verification, which has blocked more than 3 million spoofed calls from Banco do Brasil and Itaú Unibanco since June 2026.