[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzOUOs2qOdHLOJRE3-HxPHOR3H1gB87brUCRE8NvAdU4":3},{"article":4,"iocs":58,"watch_terms":78,"solutions":79,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0db19059-0952-4fd5-b0f4-329c07cee740","Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks","qilin-and-inc-exploit-palo-alto-vpn-flaw-in-ransomware-attacks-b31ace","Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials…","Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) ransomware operators are actively exploiting CVE-2026-0257, an authentication-bypass flaw in Palo Alto Networks PAN-OS GlobalProtect portal and gateway, to gain unauthorized VPN access and bypass MFA. After establishing VPN sessions, attackers target virtualization infrastructure, extract domain credentials from VMware vCenter virtual disks, and move laterally via RDP and SMB. The campaign spans 11 sectors including finance, healthcare, and government, with attackers also exploiting VMware and Veeam vulnerabilities to access backup infrastructure.","Qilin and INC ransomware groups exploit Palo Alto PAN-OS authentication bypass to breach VPN and steal domain","https:\u002F\u002Fhackread.com\u002Fqilin-inc-exploit-palo-alto-vpn-flaw-ransomware-attacks\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fqilin-inc-exploit-palo-alto-vpn-flaw-ransomware-attacks.jpg","2026-10-22T10:15:31+00:00","2026-10-22T12:00:14.791221+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Qilin (Spikey Scorpius)","threat_actor",{"name":21,"type":19},"INC (Tarnished Scorpius)",{"name":23,"type":19},"Settra",{"name":25,"type":26},"Palo Alto Networks","vendor",{"name":28,"type":29},"PAN-OS","product",{"name":31,"type":29},"VMware vCenter","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":32,"icon":34,"name":35,"slug":36},null,"Ransomware","ransomware",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[59,63,66,69,73,76],{"type":60,"value":61,"context":62},"cve","CVE-2026-0257","Authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portal and gateway, exploited by Qilin and INC ransomware operators to bypass VPN authentication and MFA.",{"type":60,"value":64,"context":65},"CVE-2023-27532","Veeam Backup & Replication vulnerability exposing encrypted credentials in configuration database, exploited by ransomware groups including Akira and FIN7.",{"type":60,"value":67,"context":68},"CVE-2026-59310","VMware vCenter exploitation campaign linked to 361 IP addresses across 47 countries.",{"type":70,"value":71,"context":72},"malware","Qilin","Ransomware operator also known as Spikey Scorpius, exploiting PAN-OS CVE-2026-0257 for VPN access.",{"type":70,"value":74,"context":75},"INC","Ransomware operator also known as Tarnished Scorpius, exploiting PAN-OS CVE-2026-0257 for VPN access.",{"type":70,"value":23,"context":77},"Ransomware malware linked to exploitation of CVE-2026-0257.",[25,28,31],{"controls":80,"vendors":165},[81,110,139],{"slug":82,"name":83,"problem":84,"products":85},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":111,"name":112,"problem":113,"products":114},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":140,"name":141,"problem":142,"products":143},"patch-management","Automated patch management","Known holes get closed in days, not months.",[144,152,157],{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":153,"product_name":154,"url":155,"description":156},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[166],{"slug":167,"name":25,"logo_path":168,"roles":169},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[170,171],"reported_by","affected",{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":184},"ransomware-groups-exploit-unpatched-palo-alto-vpn-authentication-bypass","Ransomware Groups Exploit Unpatched Palo Alto VPN Authentication Bypass","Two active ransomware groups are weaponizing CVE-2026-0257, an authentication-bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect, to gain unauthorized VPN access and circumvent multi-factor authentication entirely. Once inside, attackers pivot to virtualization infrastructure, harvest domain credentials from VMware vCenter virtual disks, and move laterally using RDP and SMB — a textbook post-exploitation chain. Compounding the damage, attackers also target backup infrastructure via Veeam vulnerabilities, deliberately eliminating the victim's recovery options before deploying ransomware. This incident illustrates how a single unpatched internet-facing appliance can serve as the entry point for a full-scale, multi-sector ransomware campaign. The breadth of affected sectors — finance, healthcare, and government — underscores the critical importance of treating VPN and perimeter device patching as a top-priority, time-sensitive obligation.",[177,178,179,180,181,182,183],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":185,"MITRE ATT&CK T1566: Phishing":186,"NIST SP 800-53 SI-2: Flaw Remediation":187,"OWASP A06:2021 Vulnerable and Outdated Components":188,"CIS Control 7: Continuous Vulnerability Management":189,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":190,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":191},"NIS2 mandates incident handling and vulnerability management practices for operators of essential services; the finance, healthcare, and government victims in this campaign are likely in scope and obligated to maintain patched, resilient network access systems.","While the initial vector here is CVE exploitation rather than phishing, the subsequent credential harvesting from vCenter virtual disks maps to credential access techniques (T1003) in the same ATT&CK framework, highlighting the need for detection coverage across the full attack chain from initial access through lateral movement.","SI-2 requires organizations to identify, report, and remediate information system flaws in a timely manner — mandatory enforcement of this control against the PAN-OS vulnerability would have prevented initial access.","The attack chain relied on an unpatched authentication vulnerability in a widely deployed VPN component, precisely the risk scenario that A06 addresses for any software or firmware dependency in an organization's stack.","CVE-2026-0257 was a known, patchable flaw in an internet-facing VPN gateway; a formal vulnerability management program with defined remediation deadlines would have closed the window before ransomware operators could exploit it.","This control requires timely identification and remediation of technical vulnerabilities in information systems, which directly applies to the failure to patch the exploited PAN-OS GlobalProtect flaw.","The authentication-bypass flaw allowed attackers to circumvent MFA entirely; stronger identity controls and continuous validation of authentication integrity at the VPN layer align directly with this function."]