Hackers Exploit PAN-OS CVE-2026-0257 to Deploy Qilin Ransomware

Ransomware operators are exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS, to enter corporate networks through GlobalProtect and deploy Qilin ransomware.

Arctic Wolf Labs investigated multiple intrusions during June 2026 that used the vulnerability as an initial access vector. The attacks progressed from unauthorized VPN access to credential theft, lateral movement, data exfiltration, and domain-wide encryption.

The official Palo Alto Networks security advisory rates CVE-2026-0257 as high severity with a CVSS 4.0 score of 7.8. However, the company gives the issue its highest suggested urgency and confirms exploit attempts against unpatched systems without mitigations.

What is CVE-2026-0257?

CVE-2026-0257 affects the GlobalProtect portal and gateway components in several PAN-OS and Prisma Access releases. It allows a remote, unauthenticated attacker to establish an unauthorized VPN connection.

The vulnerability only affects specific configurations. A GlobalProtect portal or gateway must use authentication override cookies, and a vulnerable certificate configuration must also exist.

Palo Alto Networks classifies the underlying weakness as CWE-565, Reliance on Cookies without Validation and Integrity Checking. Successful exploitation lets an attacker bypass normal perimeter authentication without first obtaining valid VPN credentials.

Product branch	Affected releases	Fixed release options
PAN-OS 12.1	Releases before 12.1.4-h6 or 12.1.7	12.1.4-h6 or 12.1.7 and later
PAN-OS 11.2	Affected maintenance releases before their respective fixes	11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later
PAN-OS 11.1	Affected maintenance releases before their respective fixes	11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later
PAN-OS 10.2	Affected maintenance releases before their respective fixes	10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later
Prisma Access 11.2	Releases before 11.2.7-h13	11.2.7-h13 and later
Prisma Access 10.2	Releases before 10.2.10-h36	10.2.10-h36 and later

Panorama and Cloud NGFW do not contain this vulnerability. Organizations using older unsupported PAN-OS releases must move to a supported fixed version.

Attackers establish unauthorized GlobalProtect sessions

After exploiting the cookie validation weakness, attackers can create VPN sessions that appear authenticated to the affected GlobalProtect gateway. This gives them interactive access to internal resources behind the firewall.

In some investigated intrusions, the attacking systems identified themselves with the hostname kali. Arctic Wolf also found overlapping source addresses between the initial exploitation attempts and later VPN sessions.

Palo Alto Networks’ Unit 42 exploitation report confirms active attempts to access GlobalProtect through CVE-2026-0257. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 29, 2026.

Qilin affiliates build several persistence channels

After entering the network, the attackers created registry Run entries with a distinctive naming pattern. Each observed value name started with an asterisk followed by six random lowercase letters.

The associated command pointed to the staged Qilin payload at C:\PerfLogs\win.exe. Arctic Wolf suggested this naming convention may represent an artifact created by the Qilin ransomware builder.

Attackers also installed legitimate remote administration and tunneling tools, including AnyDesk, Ngrok, LogMeIn, and MeshAgent. These tools provided additional access if defenders terminated the original VPN session.

Attack stage	Observed tools or techniques	Purpose
Initial access	CVE-2026-0257 and GlobalProtect VPN	Bypass authentication and enter the internal network
Persistence	Registry Run keys and scheduled tasks	Maintain access after the VPN session ends
Remote access	AnyDesk, Ngrok, LogMeIn, and MeshAgent	Create redundant communication channels
Credential theft	LSASS dumping and NTDS extraction	Obtain local and domain credentials
Lateral movement	PsExec, RDP, and administrative shares	Access and execute files on other systems
Data theft	Rclone, ProtonDrive, FileZilla, and MEGA	Transfer stolen information outside the network
Impact	Qilin ransomware	Encrypt systems and disrupt operations

Attackers dump LSASS and copy Active Directory data

The operators dumped credentials from LSASS process memory with rundll32.exe and comsvcs.dll. They saved the resulting memory dump with an .odt extension, likely to avoid rules that only detect common dump-file extensions.

They also used ntdsutil.exe with the Install From Media method to create a copy of the Active Directory database. This operation can expose password hashes for every account in the domain.

Combining LSASS credentials with the NTDS.dit database gave the attackers authentication material for broader network access. They then used compromised administrative accounts to move between workstations, servers, virtualization hosts, and domain controllers.

• Monitor rundll32.exe loading comsvcs.dll with the MiniDump function.
• Do not limit detection to files using .dmp extensions.
• Alert on ntdsutil.exe commands containing Install From Media arguments.
• Monitor unexpected access to NTDS.dit and related Volume Shadow Copies.
• Restrict the accounts permitted to perform DCSync or IFM operations.

PsExec and administrative shares support lateral movement

The attackers used SoftPerfect Network Scanner and NetExec to discover systems and validate stolen credentials. They manually browsed internal directories and checked whether remote administrative shares allowed file creation.

PsExec served as the main remote execution tool across the investigated environments. Attackers copied tools through the C$ administrative share and created PSEXESVC.exe services on targeted computers.

Remote Desktop Protocol provided another route into critical systems. Some intrusions included both accepted and rejected RDP attempts, suggesting attackers tested stolen credentials across domain controllers, backup systems, and file servers.

Some attacks included double extortion

The post-exploitation activity differed between victims. Some intrusions moved quickly to enterprise-wide encryption without evidence of data theft, while others included longer reconnaissance and large-scale credential harvesting.

In double-extortion incidents, attackers used Rclone, ProtonDrive, and FileZilla to steal data. MEGA cloud storage served as the main observed exfiltration destination, although connections to MEGA infrastructure are not inherently malicious.

The Arctic Wolf Qilin investigation says this variation may indicate multiple affiliates using shared infrastructure and ransomware tooling. Qilin operates as ransomware-as-a-service, allowing affiliates to apply different intrusion methods.

Attackers disabled security tools and cleared logs

Before deploying ransomware, attackers disabled Microsoft Defender real-time protection in some environments. This reduced the likelihood that endpoint protection would stop the payload during staging or execution.

One PowerShell routine enumerated every Windows Event Log channel containing records and cleared each one. Other intrusions used a more selective approach targeting Security, System, and PowerShell logs.

Centralized log forwarding can preserve evidence when attackers erase records stored on endpoints. Security teams should alert when PowerShell calls the EventLogSession.ClearLog method or when many unrelated log channels are cleared in quick succession.

Qilin ransomware hides in the PerfLogs directory

The attackers consistently named the ransomware executable win.exe. They staged it in C:\PerfLogs\ or copied it to remote systems through paths such as C$\Windows\Temp\win.exe.

The PerfLogs directory exists by default on Windows and may receive less file-integrity monitoring than common malware locations. Attackers manually checked access to the directory before using it for ransomware staging.

The Qilin payload required a password supplied through its command line. Without the correct password, the executable remained inactive, making automated sandbox analysis and incident-response testing more difficult.

• Monitor executable creation inside C:\PerfLogs\.
• Block program execution from PerfLogs through application control.
• Alert on processes launched with --password and --no-admin parameters.
• Review remote writes to C$\Windows\Temp\ and C$\PerfLogs\.
• Investigate unexpected PSEXESVC.exe creation.

How to patch and mitigate CVE-2026-0257

Administrators should compare every GlobalProtect portal, gateway, and Prisma Access deployment against the fixed releases in the CVE-2026-0257 advisory. All components that generate or accept authentication override cookies should receive compatible updates.

The update generates authentication override cookies through a more secure method. GlobalProtect users must authenticate again after the upgrade, even if they previously held a valid cookie.

If immediate patching is impossible, Palo Alto Networks recommends disabling authentication override or creating a new certificate dedicated exclusively to authentication override cookies. Administrators should not reuse the portal or gateway certificate.

1. Upgrade PAN-OS and Prisma Access to the appropriate fixed releases.
2. Patch every internal and external GlobalProtect portal and gateway.
3. Terminate all active GlobalProtect sessions after applying the update.
4. Disable authentication override if patching cannot occur immediately.
5. Use a new dedicated certificate for authentication override cookies.
6. Review VPN logs for unauthorized or unusual sessions.
7. Activate incident-response procedures after any suspicious gateway connection.

What defenders should investigate

Security teams should review GlobalProtect logs for sessions from hosting providers, unexpected locations, and machines reporting unusual identifiers. The hostname kali appeared in some Arctic Wolf incidents, while Unit 42 also published several suspicious generic hostnames and MAC addresses.

The Unit 42 threat brief recommends treating successful gateway-connected events associated with exploitation indicators as potential compromises. Organizations should begin incident response rather than assuming that patching alone removed the attacker.

If investigators find evidence of exploitation, they should assume attackers may have stolen domain credentials. Arctic Wolf recommends rotating administrative and service credentials, changing the KRBTGT password twice, and reviewing access to backup and cloud-storage systems.

Detection opportunity	Suspicious activity
GlobalProtect logs	Successful sessions from VPS providers, unusual countries, or devices named kali
Registry	Run values matching an asterisk followed by six lowercase letters
Processes	LSASS dumping, ntdsutil IFM activity, PsExec, Rclone, or win.exe
File system	Executables created under PerfLogs or remote administrative shares
Remote access	Unexpected AnyDesk, Ngrok, LogMeIn, MeshAgent, or RDP activity
Event logs	Multiple log channels cleared within a short period
Network traffic	Large transfers from servers or domain controllers to cloud-storage services

FAQ