Qilin and INC Ransomware Gangs Exploit Patched Palo Alto VPN Flaw to Sidestep MFA

Palo Alto Networks says ransomware operators are still exploiting a security hole in PAN-OS and Prisma Access even after a fix was released. The flaw, tracked as CVE-2026-0257 with a CVSS score of 7.8, allows an authentication bypass that attackers can use to set up unauthorized VPN connections. Palo Alto patched it in May 2026, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on May 13, 2026.

Unit 42 researchers named Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as INC) as the ransomware groups exploiting the flaw. The update followed ReliaQuest's report that Qilin and Settra were actively using it in financially motivated attacks.

According to Unit 42, the attackers use the flaw to get an initial foothold in corporate networks, then bypass multi-factor authentication to establish a VPN session. From there, they conduct internal reconnaissance with dual-use remote monitoring and management tools, move laterally via RDP and SMB, and stage tooling for credential harvesting, data exfiltration and ransomware deployment.

Targeted sectors include education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.

Unit 42 described the most significant shift in tactics as a direct pivot to the virtualization layer. In one case, attackers moved from a compromised VPN gateway to a vCenter management appliance, disabled security controls on ESXi hypervisors and used a custom tool to dump credentials offline from a domain controller's virtual disk, circumventing in-guest endpoint detection and response. Attackers have also chained the access method with exploits against Veeam backup infrastructure via CVE-2023-27532.

Arctic Wolf had previously flagged Qilin's exploitation of CVE-2026-0257 in July 2026, with attacks ranging from rapid encryption-only operations to full double extortion. Palo Alto recommends applying the latest fixes and proactively hunting for indicators of compromise.

Source: The Hackers News