Ransomware crews have turned a Palo Alto Networks VPN flaw into a front door. In an update to its threat brief published on 19 October, Palo Alto Networks' Unit 42 said operators including Qilin, which it tracks as Spikey Scorpius, and INC Ransom, which it tracks as Tarnished Scorpius, are exploiting CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway components of PAN-OS. Unit 42 added that it is aware of public reporting tying exploitation to actors using Settra ransomware.
The flaw is not new. CISA added it to its Known Exploited Vulnerabilities catalog on 13 May 2026, a public proof of concept followed on 29 May, and we reported the first wave of exploitation in June. What has changed is who is using it and what they do once they are in.
From probing to full ransomware intrusions
When Unit 42 first wrote up the activity, it described an unidentified actor attempting to reach GlobalProtect, with only a small share of probed devices actually establishing VPN sessions and no post-access behaviour or lateral movement seen. The October update describes a very different picture. According to Unit 42, attackers use the bug for an initial foothold, bypassing multi-factor authentication to open a VPN session, then typically run internal reconnaissance with dual-use remote monitoring and management (RMM) tools, move laterally over RDP and SMB, and stage tooling for credential harvesting, data theft and finally ransomware deployment.
Unit 42 says its investigations have run since early June 2026 and span education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. In other words, there is no single sector to watch: anyone with an exposed, unpatched GlobalProtect gateway is in scope.
Straight to the hypervisor, around the EDR
The most significant change in tradecraft, in Unit 42's words, is a direct pivot to the virtualization layer. In one case the attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors, and used a custom tool to dump credentials offline directly from a domain controller's virtual disk (VMDK).
That matters because it never touches the running Windows server. Reading the domain controller's disk from underneath, at the hypervisor, sidesteps the endpoint detection and response (EDR) agent inside the guest and still yields domain-wide credentials. Unit 42 also reports actors chaining this access with exploits for Veeam backup infrastructure, naming CVE-2023-27532, to widen the damage.
Patch PAN-OS, then hunt GlobalProtect logs
Unit 42 urges organizations to review the Palo Alto Networks security advisory for CVE-2026-0257 and either apply the documented workarounds and mitigations or upgrade to a fixed PAN-OS version. Because exploitation has been running for months, patching alone is not enough: any successful gateway-connected event tied to the indicators below should trigger incident response, and teams running vCenter behind a GlobalProtect gateway should check whether ESXi security settings were changed.
Unit 42's hunting guidance for GlobalProtect logs:
- Successful logins from these IP addresses, linked to activity before the proof of concept was released: 23[.]128[.]228[.]6, 104[.]207[.]144[.]154, 146[.]19[.]216[.]119, 146[.]19[.]216[.]120, 146[.]19[.]216[.]125, 179[.]43[.]172[.]213, 185[.]195[.]232[.]139, 198[.]12[.]106[.]60, 202[.]144[.]192[.]47
- Successful gateway-connected events from any IP using placeholder host IDs or device names, including aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT
- Gateway-connected events matching the proof of concept's hard-coded client values: endpoint_os_version of "Microsoft Windows 10 Pro 64-bit" with an empty source_user_info.domain
The full brief, credited to Andy Piazza and Unit 42, is available in the original report. The lesson of this one is familiar but worth repeating: a perimeter bug that looked like low-grade probing in June became a reliable entry point for the busiest ransomware crews by October, and the defenders who waited are the ones now reading about their own hypervisors.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.