Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials from VMware virtual disks.
After exploiting a vulnerability in Palo Alto Networks’ PAN-OS software to gain VPN access, attackers started targeting virtual server infrastructure and extracted domain credentials from a domain controller’s virtual disk, according to the company’s Unit 42 threat intelligence team’s latest research blog.
The incident is part of ongoing exploitation of CVE-2026-0257, an authentication-bypass flaw affecting the GlobalProtect portal and gateway. The vulnerability can allow attackers to establish VPN sessions by bypassing authentication controls, even multi-factor authentication (MFA).
In updates published on October 19 and 20, Unit 42 identified Qilin, also known as Spikey Scorpius, and Inc, aka Tarnished Scorpius, among the ransomware operators exploiting the flaw. Separate reports have linked exploitation to actors using Settra ransomware. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
🚨 ReliaQuest continues to observe active exploitation of CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. Multiple threat groups, including the Qilin and Settra ransomware operations, are exploiting the flaw to…— ReliaQuest Threat Research (@ReliaQuestTR) October 9, 2026
From VPN Access to Domain Credentials
Unit 42’s investigations, which began in early June, found attackers using remote monitoring and management (RMM) tools to survey internal networks before moving between systems over Remote Desktop Protocol (RDP) and Server Message Block (SMB).
The research covered organizations across 11 sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.
In one investigated credential-theft incident, attackers reached VMware’s vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors and used a custom tool to extract credentials offline from a domain controller’s virtual machine disk (VMDK).
Working directly with the virtual disk allowed the attackers to avoid endpoint detection and response (EDR) controls running inside the guest operating system. Unit 42 also observed attackers using exploit tools targeting Veeam backup infrastructure, including those exploiting CVE-2023-27532.
This vulnerability affects Veeam Backup & Replication and can expose encrypted credentials stored in its configuration database, potentially giving attackers access to backup infrastructure. Hackread previously reported that ransomware groups including Akira and FIN7 had exploited the flaw.
Exposed Management Interfaces
Unit 42 also found misconfigured GlobalProtect profiles exposing management interfaces to the internet on ports 4443 and 3879. Administrators should check whether these interfaces are externally accessible and follow Palo Alto Networks’ guidance to restrict access.
The findings also provide context for a separate VMware vCenter campaign covered by Hackread.com in August, when researchers linked 361 IP addresses across 47 countries to suspected exploitation of CVE-2026-59310. The vulnerabilities and campaigns differ, but both highlight the risks of attackers reaching virtualization management systems.
——————————————————–
Click Here For The Original Source.
