Ransomware groups are taking advantage of a security flaw in the Palo Alto Networks GlobalProtect VPN to circumvent multi-factor authentication (MFA) and infiltrate corporate environments. In a notable incident, hackers accessed VMware management platforms, extracting credentials directly from a virtual disk associated with a domain controller, thereby bypassing security measures within the virtual setup.
Details on the Exploitation
Palo Alto Networks’ Unit 42 outlined these activities in an update released on October 19. The vulnerability, identified as CVE-2026-0257, is linked to groups known as Spikey Scorpius and Tarnished Scorpius. Public reports have also connected this flaw to Settra ransomware operators. Ongoing investigations since June have impacted multiple industries, including healthcare and financial services, highlighting how unauthorized VPN access can escalate to credential theft and ransomware attacks.
Understanding the GlobalProtect Vulnerability
The flaw affects GlobalProtect portals and gateways, particularly in PAN-OS and Prisma Access configurations, where authentication override cookies are enabled alongside a susceptible certificate setup. Rated as High by Palo Alto Networks, with a CVSS score of 7.8, the issue demands urgent attention. Importantly, Panorama and Cloud NGFW are not impacted. Authentication override cookies allow users to reconnect without re-authentication, but vulnerabilities in this process can be exploited if the cookie certificate is reused publicly.
Attackers can forge a cookie by obtaining its public key, tricking the gateway into accepting it as legitimate authentication, thereby bypassing MFA. Once inside, they utilize remote tools to navigate internal networks, setting up for credential theft and data exfiltration.
Impact and Recommendations
One significant breach involved attackers moving from a compromised VPN gateway to VMware’s vCenter management appliance, disabling security controls to extract credentials from a virtual disk. This method bypasses typical endpoint detection, targeting the infrastructure directly rather than using traditional credential-stealing software. Additionally, attackers have targeted Veeam backup setups through another vulnerability, CVE-2023-27532, which might expose encrypted credentials in backup configurations.
Organizations are advised to scrutinize GlobalProtect logs for unusual activity and suspicious client connections. Indicators of compromise include specific IP addresses and device identifiers. Following Palo Alto Networks’ guidance, affected systems should be updated immediately, with temporary measures like disabling authentication override or generating new certificates for override cookies.
Staying vigilant and proactive in updating systems as per advisories is crucial in mitigating such vulnerabilities. While alerts from EDR tools can indicate an attack, a comprehensive understanding of the attack timeline is essential for effective defense.
