Qilin Ransomware Exploits CVE-2026-0257 Against Palo Alto GlobalProtect VPN

Arctic Wolf confirms Qilin is exploiting Palo Alto PAN-OS authentication bypass CVE-2026-0257 for initial access. Time from VPN session to ransomware encryption can be hours.

Incident overview

On 21 July 2026, Arctic Wolf Labs published an investigation confirming the Qilin ransomware group is using CVE-2026-0257 (Palo Alto Networks PAN-OS GlobalProtect authentication bypass) as the initial access vector. The group conducted multiple intrusions in June 2026; all cases traced to the same exploit.

Technical details and attack vector

Exploitation conditions

CVE-2026-0257 (CVSS 7.8) is exploitable under this configuration combination:

• GlobalProtect portal/gateway with authentication override cookie enabled
• Specific SSL certificate configuration present

Attackers can forge a valid VPN session cookie and establish a GlobalProtect session with no valid credentials. From the network, the connection is indistinguishable from legitimate remote access.

Affected versions

• PAN-OS 10.2 (pre-patch)
• PAN-OS 11.1 (pre-patch)
• PAN-OS 11.2 (pre-patch)
• PAN-OS 12.1 (pre-patch)
• Some Prisma Access versions

Attack chain analysis

Arctic Wolf observed two attack patterns:

Pattern 1: Rapid encryption

• Minimal dwell time
• Direct lateral movement to domain controllers
• Rapid ransomware deploy after credential theft
• Initial VPN session to encryption: hours only

Pattern 2: Double extortion

• Prolonged network reconnaissance
• Large-scale credential collection
• Data staged to MEGA cloud storage via Rclone
• Encryption followed by leak threats against stolen data

Persistence and tooling

• Registry Run key: 6-random-lowercase-letter naming pattern (e.g. *abcdef)
• Remote tools: AnyDesk, Ngrok, LogMeIn
• Credential theft: rundll32.exe comsvcs.dll MiniDump (disguised as .odt files)
• AD database extraction: ntdsutil.exe
• Ransomware staging: C:\\PerfLogs\\win.exe

Impact

| Metric | Details | | --- | --- | | CVSS score | 7.8 (High) | | CISA KEV | Added 29 May 2026 | | Active exploitation | Confirmed (Rapid7 observed since 17 May) | | Threat actor | Qilin (aka Agenda) RaaS |

Remediation

• Patch immediately: apply July 2026 PAN-OS patch releases
• Disable authentication override cookies: temporary mitigation if patching is not possible within 48 hours
• Terminate active sessions: force-logoff all GlobalProtect users and revoke existing authentication sessions
• Rotate credentials: reset all domain credentials, service account passwords, and the KRBTGT account
• Monitor for Rclone: check servers and domain controllers for Rclone
• Block MEGA: block outbound MEGA cloud storage traffic at the perimeter

Sources

• Arctic Wolf Cookie Crumbles report
• Beazley Security Advisory BSL-A1194
• Infosec.ge Qilin ransomware analysis