Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
According to Unit 42, the threat actors are weaponizing the flaw to gain an initial foothold into corporate networks, and then bypass multi-factor authentication (MFA) controls to establish a VPN session.
The development comes days after ReliaQuest said it detected both Qilin and Settra ransomware groups actively exploiting the flaw in financially-motivated attacks.
The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.
Besides applying the latest fixes, Palo Alto Networks is recommending that organizations proactively hunt for indicators of compromise and initiate appropriate incident response protocols if successful gateway-connected events are detected.
Upon setting up a VPN session, the attackers have been found to engage in the following post-compromise activity - Attacks mounted by these groups are said to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.
Attackers have also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws ( CVE-2023-27532 ) to inflict maximum damage.
From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK)." This approach, the network security vendor added, circumvents in-guest endpoint detection and response (EDR) and security protections, allowing the threat actors to obtain domain-wide credentials.
It's worth noting that Qilin's exploitation of CVE-2026-0257 was previously flagged by Arctic Wolf in July 2026, with attacks ranging from rapid encryption-only operations to full double-extortion.
Cybersecurity and Infrastructure Security Agency (CSIA) to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
What happened
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
According to Unit 42, the threat actors are weaponizing the flaw to gain an initial foothold into corporate networks, and then bypass multi-factor authentication (MFA) controls to establish a VPN session.
What changed
The development comes days after ReliaQuest said it detected both Qilin and Settra ransomware groups actively exploiting the flaw in financially-motivated attacks.
The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.
Who is affected
Besides applying the latest fixes, Palo Alto Networks is recommending that organizations proactively hunt for indicators of compromise and initiate appropriate incident response protocols if successful gateway-connected events are detected.
Upon setting up a VPN session, the attackers have been found to engage in the following post-compromise activity - Attacks mounted by these groups are said to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.
Why it matters
Attackers have also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws ( CVE-2023-27532 ) to inflict maximum damage.
From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK)." This approach, the network security vendor added, circumvents in-guest endpoint detection and response (EDR) and security protections, allowing the threat actors to obtain domain-wide credentials.
Technical details
It's worth noting that Qilin's exploitation of CVE-2026-0257 was previously flagged by Arctic Wolf in July 2026, with attacks ranging from rapid encryption-only operations to full double-extortion.
Cybersecurity and Infrastructure Security Agency (CSIA) to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
Response
It was patched by Palo Alto Networks in May 2026 and was added by the U.S.
Attribution
The Hacker News: Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.