/
← Voltar ao feed
critical professional services legal services transportation logistics healthcare education financial services government manufacturing energy high technology hospitality transportation and logistics utilities retail finance

Ransomware groups Qilin, INC and Settra exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257, pivoting to vCenter/ESXi

4 fonte(s) · 4 atualização(ões) · publicado 19/10/2026 19:35 · coletado há 2 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 23/10/2026 00:05; os links antigos trazem para cá.

Fontes: theregister.com ↗ thehackernews.com ↗ gbhackers.com ↗ unit42.paloaltonetworks.com ↗

Palo Alto Networks Unit 42 reported on October 19, 2026 that ransomware operators are still actively exploiting CVE-2026-0257 (CVSS 7.8), an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. The flaw lets attackers bypass MFA and open unauthorized VPN sessions. Unit 42 attributes exploitation attempts to Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) (unit42.paloaltonetworks.com, thehackernews.com). ReliaQuest separately saw Qilin and Settra ransomware actors exploiting it (thehackernews.com, theregister.com). The CVE was patched and added to the CISA KEV catalog on May 13, 2026 (theregister.com, unit42.paloaltonetworks.com), but Unit 42 has investigated intrusions since early June 2026 across many sectors. These include education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail (theregister.com). The most notable change in tactics is a direct pivot from the VPN foothold to the virtualization layer (vCenter and ESXi). Palo Alto Networks has not disclosed the number of victims (theregister.com).

Entenda a falha

A vulnerabilidade

CVE-2026-0257 (CVSS 7.8) is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS. A remote attacker who can reach an exposed portal or gateway can bypass security controls, including MFA, and open an unauthorized VPN session into the corporate network. Exposure requires authentication override cookies to be enabled together with a specific certificate configuration. Panorama and Cloud NGFW are not affected, and Prisma Access is also named as affected, mainly in hybrid deployments with on-premises firewalls. The articles do not list version numbers, only that fixed releases exist. Attackers also chain this access with CVE-2023-27532 against Veeam backup infrastructure.

Como funciona

A client connects to the GlobalProtect portal or gateway and presents an authentication override cookie, which the service accepts as proof that the user already authenticated. When override cookies and the specific certificate configuration are in place, the cookie is not validated or integrity-checked well enough, so the service accepts one the attacker was able to supply. The gateway then creates a VPN session without the normal login and MFA steps, and the log records a gateway-connected event. From that foothold, operators run reconnaissance with RMM tools, move over RDP and SMB, and in one case went on to vCenter and ESXi.

Por que é vulnerável

Palo Alto Networks classifies the weakness as inadequate validation and integrity checking of cookies. The service trusts the authentication override cookie without properly verifying it, in the setup where those cookies and a specific certificate configuration are used. The articles do not say why it went unnoticed. Fixed releases regenerate the cookies securely, which is why users must re-authenticate after upgrading. The workarounds are to disable authentication override or to generate a new certificate dedicated to those cookies.

Onde está

No article names a file, function or commit; the affected setting is authentication override cookies combined with a specific certificate configuration on the GlobalProtect portal and gateway.

Como foi descoberta

Palo Alto Networks disclosed and patched the flaw on May 13, 2026, and CISA added it to KEV the same day. According to The Register, the vendor first rated it medium and said it had seen attempts but no malicious exploitation. Rapid7 later reported successful exploitation across several customers dating back to at least May 17. Unit 42 saw an unidentified actor before the PoC appeared and has investigated intrusions since early June. Arctic Wolf flagged Qilin exploitation in July, and ReliaQuest reported Qilin and Settra. On October 19 Unit 42 confirmed ransomware use by Qilin and INC. The articles do not say who found the flaw or how it was reported to the vendor.

PoC pública

Unit 42 refers to a public proof of concept released on May 29, 2026, but the articles do not say who published it or where. Its code contains hard-coded client values, namely the endpoint OS version Microsoft Windows 10 Pro 64-bit and an empty source_user_info.domain, which defenders can search for in GlobalProtect logs to spot post-PoC activity. Its exact maturity is not described, but exploitation is confirmed in the wild by several ransomware groups, so unpatched exposed gateways should be treated as urgent.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:20.

Detalhes técnicos

  • Exposure conditions: The flaw is classed as inadequate validation and integrity checking of cookies. It is exposed only when authentication override cookies are enabled together with a specific certificate configuration. Panorama and Cloud NGFW are not affected (gbhackers.com). Prisma Access is also named as affected (thehackernews.com).
  • Post-access activity: Attackers gain a foothold, bypass MFA and establish a VPN session. They then run internal reconnaissance with dual-use RMM tools and move laterally via RDP and SMB. Finally they stage tooling for credential harvesting, data exfiltration and ransomware deployment.
  • Virtualization pivot: In one case attackers moved from the compromised VPN gateway to the vCenter appliance and disabled the execInstalledOnly control on ESXi hosts. They then used a custom tool for offline credential dumping against a domain controller's virtual disk (VMDK). This bypasses in-guest EDR and yields domain-wide credentials.
  • Veeam chaining: Initial access is chained with exploit tooling for Veeam backup infrastructure via CVE-2023-27532.
  • Early activity: Activity before the public PoC release on May 29, 2026 came from an unidentified actor, and only a small portion of probed devices established VPN sessions (unit42.paloaltonetworks.com). Post-PoC activity can be found by searching for the hard-coded client values from the PoC code: endpoint_os_version 'Microsoft Windows 10 Pro 64-bit' and an empty source_user_info.domain.
  • Hunting values reported by gbhackers.com: device identifiers aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT, and historical source IPs 23.128.228[.]6, 104.207.144[.]154 and 179.43.172[.]213. Unit 42 advises searching for the client identifiers across all source addresses. The Unit 42 text provided does not reproduce its specific IPs, host names or MAC addresses, so these values come from the secondary source only.
  • Qilin activity: Arctic Wolf flagged Qilin exploitation in July 2026, ranging from rapid encryption-only operations to full double extortion (thehackernews.com).

Remediação

  • Review the Palo Alto Networks advisory for CVE-2026-0257. Upgrade all affected GlobalProtect portals and gateways (PAN-OS and Prisma Access) to the latest fixed releases. Fixed releases regenerate cookies, so users must re-authenticate (gbhackers.com).
  • Alternatively, apply the workarounds: disable authentication override, or generate a new certificate dedicated to authentication override cookies (gbhackers.com).
  • Hybrid Prisma Access deployments must also upgrade affected on-premises firewalls to keep cookie compatibility (gbhackers.com).
  • Hunt in GlobalProtect logs for successful gateway-connected events matching the Unit 42 indicators, suspicious host IDs or device names, and the PoC hard-coded values. Treat any match as a trigger for incident response.
  • Identify exposed PAN-OS gateways and GlobalProtect portals, for example with Cortex Xpanse (unit42.paloaltonetworks.com).

Relatos divergentes

  • Severity: The bug was initially rated medium severity with no exploitation observed (theregister.com). Later sources give CVSS 7.8 (thehackernews.com, gbhackers.com), and exploitation is now confirmed.
  • Start of exploitation: Rapid7 saw successful exploitation across multiple customers dating back to at least May 17 (theregister.com). Unit 42 dates its investigations to early June and notes unidentified-actor activity before the May 29 PoC (unit42.paloaltonetworks.com). Arctic Wolf dates Qilin exploitation to July (thehackernews.com). These are different observers rather than strictly contradictory, but the May 17 date is the earliest reported.
  • Affected products: thehackernews.com says PAN-OS and Prisma Access are affected. gbhackers.com says Panorama and Cloud NGFW are not, and that Prisma Access is relevant mainly in hybrid deployments with on-premises firewalls.
  • Targeted sectors: The sector lists differ between sources. The fullest list is in theregister.com, and Unit 42 itself highlights professional and legal services and transportation and logistics.
  • Settra attribution: Unit 42 describes it as public reporting. ReliaQuest is the named source (thehackernews.com, theregister.com).

Linha do tempo

  1. theregister.com ↗ · pub. 20/10/2026 14:33 · coletado 20/10 16:00

    Qilin, INC and Settra ransomware crews exploit PAN-OS GlobalProtect bug CVE-2026-0257 since June, pivoting to ESXi

    Adds that Unit 42 has been investigating these intrusions since early June, that the bug was initially rated medium severity with no exploitation observed, and that Rapid7 saw successful exploitation across multiple customers dating back to at least May 17. Palo Alto Networks did not disclose the number of victims.

    ler a análise desta fonte

    Adds that Unit 42 has been investigating these intrusions since early June, that the bug was initially rated medium severity with no exploitation observed, and that Rapid7 saw successful exploitation across multiple customers dating back to at least May 17. Palo Alto Networks did not disclose the number of victims.

    Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and initially rated medium severity, but Rapid7 later observed successful exploitation dating back to at least May 17. ReliaQuest reports that other threat groups, including Settra ransomware operators, are also abusing the bug for initial access. Palo Alto Networks did not say how many organizations are affected.

    Technical Details

    • Attackers use the flaw to gain a foothold, bypass MFA and establish an unauthorized VPN session. They then move laterally via RDP and SMB, deploy tooling for credential harvesting and data theft, and finally deploy ransomware.
    • The most significant TTP evolution is the direct pivot to the virtualization layer. In one case, attackers moved from the compromised VPN gateway to the vCenter management appliance and disabled the execInstalledOnly control on ESXi hypervisors. They then used a custom tool for offline credential dumping against a domain controller's virtual disk (VMDK), bypassing in-guest EDR and yielding domain-wide credentials.
    • Unit 42 has also seen the initial access chained with CVE-2023-27532, which targets Veeam backup infrastructure.
    • Affected sectors include education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

    Remediation

    • Patch vulnerable PAN-OS software immediately.
    • Hunt for signs of prior compromise using Unit 42's published indicators of compromise.
  2. thehackernews.com ↗ · pub. 20/10/2026 12:32 · coletado 20/10 14:00

    Qilin and INC Ransomware Exploit Palo Alto PAN-OS Flaw CVE-2026-0257 to Bypass MFA and Pivot to Virtualization Layer

    Adds that ReliaQuest observed both Qilin and Settra actively exploiting the flaw days earlier, that Arctic Wolf had flagged Qilin exploitation as early as July 2026, that the vulnerability was patched in May 2026 and added to the CISA KEV catalog on May 13, 2026, and that Prisma Access is also affected. It also names the sectors targeted.

    ler a análise desta fonte

    Adds that ReliaQuest observed both Qilin and Settra actively exploiting the flaw days earlier, that Arctic Wolf had flagged Qilin exploitation as early as July 2026, that the vulnerability was patched in May 2026 and added to the CISA KEV catalog on May 13, 2026, and that Prisma Access is also affected. It also names the sectors targeted.

    Palo Alto Networks reports continued ransomware exploitation of CVE-2026-0257 (CVSS 7.8), an authentication bypass in PAN-OS and Prisma Access that lets attackers set up unauthorized VPN sessions and bypass MFA. Unit 42 attributes the activity to Spikey Scorpius (Qilin) and Tarnished Scorpius (INC). ReliaQuest separately saw both Qilin and Settra exploiting the flaw in financially motivated attacks. The flaw was patched in May 2026 and added to the CISA KEV catalog on May 13, 2026, but exploitation continues. Targeted sectors are broad, including education, financial services, healthcare, manufacturing, government, utilities and energy, and retail.

    Technical Details

    • Attackers exploit the flaw for initial access, bypass MFA and establish a VPN session. They then run internal reconnaissance with dual-use RMM tools, move laterally via RDP and SMB, and stage tooling for credential harvesting, data exfiltration and ransomware deployment.
    • The most significant TTP evolution is the direct pivot to the virtualization layer. In one case, attackers moved from the compromised VPN gateway to the vCenter appliance, disabled the execInstalledOnly control on ESXi hypervisors, and used a custom tool for offline credential dumping against a domain controller's virtual disk (VMDK). This evades in-guest EDR and yields domain-wide credentials.
    • The initial access is chained with tooling targeting Veeam backup infrastructure via the known flaw CVE-2023-27532.
    • Arctic Wolf flagged Qilin exploitation of CVE-2026-0257 in July 2026, with attacks ranging from rapid encryption-only operations to full double extortion.

    Remediation

    • Apply the latest fixes for PAN-OS and Prisma Access.
    • Proactively hunt for indicators of compromise and initiate incident response if successful gateway-connected events are detected.
  3. gbhackers.com ↗ · pub. 20/10/2026 09:30 · coletado 20/10 11:00

    Qilin and Tarnished Scorpius Exploit PAN-OS GlobalProtect Flaw CVE-2026-0257 to Bypass MFA and Deploy Ransomware

    ler a análise desta fonte

    Unit 42 reported on October 19 that ransomware operators are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS to bypass authentication and MFA and establish unauthorized VPN sessions. Two groups, Spikey Scorpius (Qilin) and Tarnished Scorpius, are using the flaw, and public reporting also links the activity to actors deploying Settra ransomware. Investigations began in early June 2026 and cover healthcare, education, financial services, government, manufacturing and energy. A notable escalation is direct targeting of virtualization management infrastructure (vCenter and ESXi) after VPN access is obtained.

    Technical Details

    • The flaw affects the GlobalProtect portal and gateway. It is exposed only when authentication override cookies are enabled together with a specific certificate configuration. It is classed as inadequate validation and integrity checking of cookies (CVSS 7.8). Panorama and Cloud NGFW are not affected.
    • Post-access activity: internal reconnaissance with dual-use RMM tools, lateral movement over RDP and SMB, and tooling for credential harvesting, data exfiltration and ransomware deployment.
    • In one case, intruders accessed a vCenter appliance, disabled the execInstalledOnly control on ESXi hosts, and used custom tools to extract credentials offline from a domain controller's VMDK. This bypasses in-guest EDR.
    • Attackers also combine the initial compromise with tooling targeting Veeam backup infrastructure via CVE-2023-27532.
    • Hunting indicators in GlobalProtect logs: device identifiers aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT; endpoint OS "Microsoft Windows 10 Pro 64-bit" with an empty source_user_info.domain field. Historical source IPs: 23.128.228[.]6, 104.207.144[.]154, 179.43.172[.]213. Unit 42 advises searching for the client identifiers across all source addresses.

    Remediation

    • Upgrade all affected GlobalProtect portals and gateways to the latest fixed releases. Fixed releases regenerate cookies, so users must re-authenticate.
    • Alternatively, disable authentication override or generate a new certificate dedicated to authentication override cookies.
    • Hybrid Prisma Access deployments must also upgrade affected on-premises firewalls to keep cookie compatibility.
    • Treat any successful connection matching the indicators as a trigger for incident response.
  4. unit42.paloaltonetworks.com ↗ · pub. 19/10/2026 19:35 · coletado 19/10 21:00 primeiro registro

    Ransomware groups Qilin, Inc and Settra actors exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257, pivoting to vCenter/ESXi

    ler a análise desta fonte

    Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc). Public reporting also attributes exploitation to actors using Settra ransomware. The CVE was added to the CISA KEV catalog on May 13, 2026, and Unit 42 investigations have been ongoing since early June 2026 across industries including professional and legal services and transportation and logistics.

    Technical Details

    • Attackers use the flaw for an initial foothold, bypass MFA and establish a VPN session. They then run internal reconnaissance with dual-use RMM tools, move laterally via RDP and SMB, and stage tooling for credential harvesting, data exfiltration and ransomware deployment.
    • The most significant TTP evolution is a direct pivot to the virtualization layer. In one case attackers moved from the compromised VPN gateway to the vCenter management appliance and disabled ESXi security controls (execInstalledOnly). They then used a custom tool for offline credential dumping against a domain controller's virtual disk (VMDK), which bypasses in-guest EDR.
    • Actors were also seen chaining this access with exploit tools targeting Veeam backup infrastructure (CVE-2023-27532).
    • Early activity (before the May 29, 2026 PoC release) came from an unidentified actor. Only a small portion of probed devices established VPN sessions. Post-PoC activity can be found by searching for hard-coded client values from the PoC code, such as endpoint_os_version 'Microsoft Windows 10 Pro 64-bit' and an empty source_user_info.domain.
    • The article's specific IP addresses, host names and MAC addresses are not reproduced in the text provided.

    Remediation

    • Review the Palo Alto Networks security advisory for CVE-2026-0257 and apply the available workarounds and mitigations, or upgrade to a fixed PAN-OS version.
    • Hunt in GlobalProtect logs for successful gateway-connected events from the published indicators, suspicious host IDs or device names, and the PoC hard-coded values.
    • Activate incident response for any successful gateway-connected event linked to these indicators.
    • Identify exposed PAN-OS gateways and GlobalProtect portals, for example with Cortex Xpanse.