Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks

Two active ransomware groups are weaponizing CVE-2026-0257, an authentication-bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect, to gain unauthorized VPN access and circumvent multi-factor authentication entirely. Once inside, attackers pivot to virtualization infrastructure, harvest domain credentials from VMware vCenter virtual disks, and move laterally using RDP and SMB — a textbook post-exploitation chain. Compounding the damage, attackers also target backup infrastructure via Veeam vulnerabilities, deliberately eliminating the victim's recovery options before deploying ransomware. This incident illustrates how a single unpatched internet-facing appliance can serve as the entry point for a full-scale, multi-sector ransomware campaign. The breadth of affected sectors — finance, healthcare, and government — underscores the critical importance of treating VPN and perimeter device patching as a top-priority, time-sensitive obligation.