Qilin ransomware exploits critical Palo Alto VPN flaw to breach corporate networks

Issue was patched in May

Qilin ransomware gang is actively exploiting a critical vulnerability in Palo Alto Networks' GlobalProtect VPN software to infiltrate corporate networks, despite security updates having been available for months.

Security firm Arctic Wolf said it had investigated multiple ransomware incidents in June in which attackers gained initial access by exploiting the flaw, tracked as CVE-2026-0257, before deploying Qilin ransomware across victims' networks.

The findings have since been reinforced by the US Cybersecurity and Infrastructure Security Agency (CISA), which confirmed the vulnerability has been used in ransomware attacks.

The flaw affects Palo Alto Networks' PAN-OS software and allows attackers to establish unauthorised VPN sessions without valid credentials under certain configurations where authentication override cookies are enabled.

Patch available but attacks continue

Palo Alto Networks released patches for the vulnerability on 13th May after identifying attempts to exploit unpatched systems.

Days later, security researchers at Rapid7 reported seeing the flaw used against multiple organisations, prompting wider warnings about active exploitation.

The vulnerability carries a CVSS severity score of 7.8 and affects several supported PAN-OS releases, including versions in the 10.2, 11.1, 11.2 and 12.1 branches, as well as certain Prisma Access deployments.

Successful exploitation enables remote attackers to bypass authentication and establish VPN connections without legitimate user credentials.

The risk prompted CISA to add the flaw to its Known Exploited Vulnerabilities catalogue on 29th May, directing US federal civilian agencies to secure vulnerable GlobalProtect gateways within three days.

Multiple Qilin affiliates

Arctic Wolf said its investigations suggest that several affiliates operating under Qilin's ransomware-as-a-service (RaaS) model are exploiting the vulnerability rather than a single coordinated group.

According to the company, the post-compromise activity varied significantly between incidents.

Some intrusions resulted in rapid encryption of systems, while others involved data theft followed by double-extortion tactics in which victims were threatened with the public release of stolen information if ransoms were not paid.

Researchers said the differing methods point to multiple operators using the same exploit to gain access before carrying out their own attacks.

The company also warned that exploitation is likely to continue, citing ongoing internet-wide scanning activity and the tendency for RaaS groups to distribute effective attack techniques among numerous affiliates.

Thousands of internet-facing systems remain exposed

Internet monitoring organisations estimate that a substantial number of GlobalProtect VPN gateways remain accessible online.

Threat monitoring service Shadowserver tracks more than 167,000 exposed GlobalProtect instances, while search engine Shodan has identified more than 172,000 internet-facing systems with GlobalProtect signatures.

It remains unclear how many of those systems have already been patched or represent decoy environments used by defenders.

Qilin ransomware

Qilin emerged in 2022 under the name "Agenda" before rebranding into one of the world's most active RaaS operations.

The group is known for encrypting systems while stealing sensitive data, using the threat of publication on its leak site to pressure organisations into paying ransoms.

The group recruits affiliates through underground cybercrime forums and supplies them with a toolkit that enables them to generate customised ransomware payloads for individual attacks.

Its claimed victims include organisations across healthcare, education, manufacturing, government and professional services, with high-profile targets including Nissan, Asahi, Synnovis, Lee Enterprises and Australia's Court Services Victoria.