Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials from VMware virtual disks.
After exploiting a vulnerability in Palo Alto Networks’ PAN-OS software to gain VPN access, attackers started targeting virtual server infrastructure and extracted domain credentials from a domain controller’s virtual disk, according to the company’s Unit 42 threat intelligence team’s latest research blog.
The incident is part of ongoing exploitation of CVE-2026-0257, an authentication-bypass flaw affecting the GlobalProtect portal and gateway. The vulnerability can allow attackers to establish VPN sessions by bypassing authentication controls, even multi-factor authentication (MFA).
In updates published on October 19 and 20, Unit 42 identified Qilin, also known as Spikey Scorpius, and Inc, aka Tarnished Scorpius, among the ransomware operators exploiting the flaw. Separate reports have linked exploitation to actors using Settra ransomware. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
