Palo Alto Networks researchers warned that ransomware operators have stepped up exploitation of a high-severity flaw in the company’s GlobalProtect portal, months after it was first disclosed.
The authentication bypass vulnerability, tracked as CVE-2026-0257, allows an attacker to establish unauthorized VPN connections to the remote-access product. The flaw has a severity score of 7.8 out of 10.
Researchers warn that Qilin and INC ransomware groups are exploiting the vulnerability, according to a report by Unit 42, the threat intelligence and incident response arm of Palo Alto Networks. The company tracks those groups under the names Spikey Scorpius and Tarnished Scorpius, respectively.
On Oct. 9, researchers from ReliaQuest reported exploitation activity linked to multiple threat groups, including Qilin and Settra ransomware, according to a post on X. Hackers were exploiting the flaw in order to launch unauthorized VPN sessions and establish initial access into internal computer networks.
“About five months after disclosure, the flaw has become a reliable way into networks for ransomware groups, and that will likely continue over the next three months as more groups and access brokers adopt it,” Brandon Tirado, vice president at ReliaQuest’s GreyMatter Operations, told Cybersecurity Dive.
ReliaQuest warned that because the threat activity originated from internal VPNs, it might appear to be a legitimate remote-access session and go undetected. They warned that additional threat activity, including credential theft, lateral movement, data theft and ransomware deployment, could take place prior to such detection.
Researchers have observed deployment of multiple tools, such as Cobalt Strike, BloodHound and SharpHound, in attacks.
Researchers from Arctic Wolf investigated multiple attacks in June linked to Qilin ransomware, according to a blog post from the cybersecurity firm. Those attacks varied from rapid encryption to double extortion, suggesting related activity from Qilin affiliate groups under a ransomware-as-a-service operation.
“The timeline suggests that access obtained through exploitation can be quickly converted into persistent remote access and hands-on-keyboard operations that ultimately enable ransomware deployment,” said Justin Moore, director of adversary operations at Arctic Wolf.
Unit 42 researchers have been investigating the threat activity since June. Targets span various industries, including education, financial services, healthcare, IT, manufacturing and government.
A significant aspect is that attackers, after successful exploitation, pivot to the virtualization layer, according to Unit 42 researchers. In one case, the hacker moved from a compromised VPN to a VMware vCenter management appliance, researchers found. Security controls on an ESXi hypervisor were disabled, and a custom tool was used to perform offline credential dumping against a domain controller’s virtual disk.
This particular tactic allows the hacker to bypass endpoint detection and response, Unit 42 said.
——————————————————-
Click Here For The Original Source.
