Cybersecurity experts have identified an active exploitation of a critical flaw in Palo Alto Networks firewalls, enabling cybercriminals to infiltrate corporate networks and deploy the Qilin ransomware. This alarming discovery was highlighted in recent research conducted by Arctic Wolf Labs.
Understanding the PAN-OS Vulnerability
The vulnerability, cataloged as CVE-2026-0257 with a CVSS score of 7.8, affects the GlobalProtect portal and gateway in PAN-OS. This flaw becomes a significant concern when authentication override cookies are used in conjunction with particular certificate setups. Such a configuration allows attackers to completely bypass login controls, establishing seemingly legitimate VPN sessions without authentication.
Versions impacted include PAN-OS 12.1, 11.2, 11.1, and 10.2 before certain patched builds, alongside specific releases of Prisma Access. Palo Alto Networks has acknowledged limited but active exploitation instances.
Exploitation Tactics and Methods
During the intrusions analyzed by Arctic Wolf, attackers leveraged compromised VPN sessions to directly access victim networks, bypassing perimeter authentication. Once inside, they executed a swift and systematic strategy to maintain control.
The attackers established persistence by using registry Run keys with uniquely patterned names. They utilized remote access tools such as AnyDesk, Ngrok, and LogMeIn to ensure ongoing connectivity. Credential dumping from LSASS memory was disguised as a ‘.odt’ file to avoid detection, and the entire Active Directory database was extracted for comprehensive domain access.
Post-Exploitation Activities and Countermeasures
Post-infiltration, the tactics varied greatly. Some attackers rapidly initiated encryption, while others focused on reconnaissance, large-scale credential harvesting, and data theft. This diversity is characteristic of ransomware-as-a-service (RaaS) models, where affiliates share tools but customize their attack strategies.
To mitigate these threats, Arctic Wolf recommends immediate patching of the CVE-2026-0257 vulnerability across all PAN-OS and Prisma Access deployments. Terminating all active GlobalProtect sessions post-patching, rotating domain credentials, and monitoring unusual executions from the C:PerfLogs directory are crucial steps in enhancing security.
Finally, forwarding Windows Event Logs to a centralized SIEM is advised to preserve critical evidence, even if local logs are manipulated or erased. Arctic Wolf’s analysis indicates that exploitation of this flaw, linked to Qilin ransomware attacks, is an ongoing risk driven by broad scanning activities and the RaaS framework’s exploitation distribution.
Strengthening your Security Operations Center (SOC) with accelerated threat detection and response capabilities is essential in combating these evolving cyber threats. Integrating tools like ANY.RUN can significantly enhance your SOC’s efficiency and effectiveness.
