al-ice.ai

Four Months Through the Front Door: Qilin and INC Turned a Patched PAN-OS VPN Bypass into Ransomware

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 19 October 2026 Palo Alto Networks’ Unit 42 updated its threat brief on CVE-2026-0257 — the PAN-OS GlobalProtect authentication bypass disclosed in May — to name the crews industrializing it: Qilin and INC ransomware operators have been exploiting the flaw since early June, riding forged VPN sessions past multi-factor authentication and into healthcare, education, government, and energy networks. Unit 42’s incident responders have been working intrusions tied to this single vulnerability for nearly five months; Help Net Security’s 21 October account adds ReliaQuest’s parallel tracking of Qilin and Settra with Cobalt Strike, BloodHound, and SharpHound in the activity. The patch has existed since May. The exploitation never stopped.

This is a sequel, not a new vulnerability — which is exactly why it belongs here. We covered the May disclosure and CISA KEV listing and the June active-exploitation wave: a single forged-cookie HTTP request built from the appliance’s public TLS certificate, initially rated medium, escalated to critical (CVSS 7.8) after Rapid7 confirmed exploitation. What October adds is the operational ending — which crews, which technique chain, and how long the window stayed open. For teams whose GPU clusters and model-serving estates sit behind GlobalProtect, the relevant question was never the CVSS; it is whether a May patch got applied before a June intrusion, because ReliaQuest warns “patching alone may not remove access established before remediation.”

The chain: forged cookie, dead MFA, offline domain credentials

The entry is unchanged and still trivial: CVE-2026-0257 stems from firewalls relying on cookies without detailed validation and integrity checking, letting unauthenticated attackers forge a session and walk through the VPN. What Unit 42’s senior director of threat intelligence Andy Piazza describes next is the part that should retire “MFA will save us” as a mitigation for this class: “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication controls to establish a VPN session.” The forged session is the authenticated session — there is no MFA prompt left to answer, because the appliance believes authentication already happened.

Inside, the operators work like administrators: legitimate IT management tools for discovery and lateral movement, password and data theft tooling, then ransomware. The investigated case Unit 42 details is the one to study: from the compromised VPN gateway to the vCenter management appliance, security controls switched off on the ESXi hypervisors, then a custom tool run against a domain controller’s virtual disk to extract credentials offline — a tactic Unit 42 says “bypasses in-guest endpoint detection and response and security controls.” Your EDR sees nothing because nothing malicious executes inside the guest; the disk is read from below. Any virtualized ML estate — vCenter-managed GPU hosts, domain-joined training clusters — should read that sentence twice. Unit 42 also observes the crews chaining Veeam backup infrastructure exploitation (CVE-2023-27532) behind the VPN access — the same backup-targeting instinct six agencies documented in SafePay’s AA26-293A playbook this week.

The camouflage: intruders who look like remote employees

ReliaQuest’s contribution to the picture is the detection problem: because access arrives through the organization’s own VPN, malicious activity can resemble legitimate remote work and may stay invisible until credential theft, lateral movement, data theft, or ransomware deployment is underway. The firm assesses exploitation is “highly likely to continue over the next three months” as ransomware groups and initial access brokers hunt unpatched systems — and, by the same logic, already-compromised ones. Qilin’s presence here is consistent with its VPN-bypass habit: the crew has been riding Check Point’s IKEv1 auth bypass (CVE-2026-50751) since May. Edge authentication bypasses are not one crew’s opportunism; they are a standing ransomware access strategy.

The throughline from May to October is a severity-rating failure with a body count. Palo Alto Networks disclosed at medium on 13 May; on 29 May it acknowledged “limited exploit attempts”; Rapid7 had already seen customer targeting from 17 May and a second wave on 21 May. Five months later the same flaw is a named ransomware initial-access vector across four sectors. Under-rated edge flaws do not get a second chance at a first impression — they get a four-month exploitation window.

What to do

  • Assume pre-patch access, then prove otherwise. Upgrade affected PAN-OS and Prisma Access deployments immediately — but start from ReliaQuest’s warning that patching does not evict established access. Hunt VPN sessions back to mid-May: unexpected connections, sessions with hostnames such as “kali,” and any GlobalProtect logins inconsistent with HR/IdP records of remote staff.
  • Disable authentication override cookies where unneeded, then kill every active session. Both Unit 42 and ReliaQuest prescribe the same sequence: patch, remove the bypass primitive, and terminate all active GlobalProtect sessions after patching so forged sessions die with the vulnerable code.
  • Protect the virtualization control plane as crown jewels. vCenter and ESXi admin paths must not be reachable from VPN-connected sessions without additional phishing-resistant authentication and anomaly alerting; snapshot and backup the virtualization management layer itself, and treat Veeam infrastructure (CVE-2023-27532) as a co-target — patch it in the same change window.
  • Instrument below the guest. Offline virtual-disk credential extraction defeats in-guest EDR by design. Hypervisor-level integrity monitoring, ESXi lockdown-mode auditing, and alerts on security-control changes at the host layer are the compensating controls — especially where domain controllers and GPU-node hosts are virtualized neighbors.

Our write-up is analysis of Help Net Security’s 21 October 2026 reporting on Unit 42’s 19 October threat-brief update and ReliaQuest’s tracking; the Unit 42 brief and ReliaQuest research are carried via that reporting, not read first-hand. We reproduced no exploit, contacted no infrastructure, and tested nothing. The May/June disclosure and exploitation history is per our own earlier briefings linked above.

Sources: