Recent findings reveal that ransomware groups continue to exploit a previously patched vulnerability in Palo Alto Networks’ software, posing significant security risks. The flaw, identified as CVE-2026-0257 with a severity score of 7.8, allows unauthorized VPN connections, bypassing multi-factor authentication (MFA). This vulnerability was addressed by Palo Alto Networks in May 2026 and subsequently listed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as a known exploited vulnerability.
Ransomware Actors Targeting Weaknesses
Security researchers from Unit 42 have identified specific ransomware groups exploiting this flaw, including Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as INC). These groups have been found to manipulate the vulnerability to gain initial access to corporate networks. Once inside, they bypass MFA controls to establish VPN sessions, further infiltrating the network.
After securing a VPN session, attackers conduct internal reconnaissance using remote monitoring and management (RMM) tools. Their activities include lateral movement within the network through protocols like RDP and SMB, as well as deploying tools for credential theft, data exfiltration, and ransomware execution.
Multi-Sector Impact and Attack Techniques
The sectors affected by these attacks are extensive, spanning education, finance, healthcare, technology, and more. A significant shift in tactics involves attackers transitioning to the virtualization layer after exploiting the vulnerability. In one instance, attackers moved from a compromised VPN gateway to a vCenter management appliance, disabling security measures to extract credentials from a domain controller’s virtual disk.
This method bypasses traditional endpoint detection and response (EDR) systems, enabling attackers to gain domain-wide access. Additionally, these groups have been observed using other exploit tools to target backup infrastructures, such as Veeam, by leveraging known vulnerabilities like CVE-2023-27532 for extensive damage.
Mitigation and Response Recommendations
Given the ongoing exploitation, organizations are strongly advised to implement the latest security patches and actively search for signs of compromise. Palo Alto Networks stresses the importance of deploying incident response protocols if suspicious activities are detected, especially those connected to the VPN gateway.
Earlier in July 2026, Arctic Wolf highlighted Qilin’s use of CVE-2026-0257 in attacks ranging from rapid encryption to full double-extortion strategies. As threats evolve, maintaining robust security practices and vigilance is crucial in mitigating the risks posed by such sophisticated cyber threats.
