[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftQrDiTDfQwvPyemhzfIcKX96axq-rkGaS7XrY9n6B6Y":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"a17614c5-c119-42e1-b2b1-fedf6dbc6398","Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access","qilin-ransomware-attackers-exploit-pan-os-authentication-bypass-for-initial-acce-c18df8","Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway","Threat actors are leveraging a patched Palo Alto Networks PAN-OS vulnerability (CVE-2026-0257) to gain initial access and deploy Qilin ransomware. The authentication bypass flaw allows unauthenticated attackers to establish VPN sessions, leading to credential harvesting, lateral movement, and eventual ransomware deployment. Post-exploitation activities vary, suggesting multiple affiliates operating under a ransomware-as-a-service model, with attackers employing techniques to clear logs and disable security features.","Qilin ransomware exploits PAN-OS auth bypass for initial access, evading detection.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fqilin-ransomware-attackers-exploit-pan.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgP1HNhUk3hMm0HOAQBAVExGT5-PQfrxeAtKrKRpG_eaXz5qEtVKiuH4-nOVMVdbtZ5XVzfk-hM-eFwpS0IAZNpGkp2DmE4wiNauEA3GT-t1UtLNGjtyVuDRPezJSyj4jEw8zeNgoPnyloZe_6K_vM1-nfYYoehFdoWRgVzVnmJUF3wwfamG0BgDdN1BvMJ\u002Fs1600\u002Fransomware-attack.jpg","2026-07-21T14:04:57+00:00","2026-07-21T16:00:26.07729+00:00",9,[17,20,23],{"name":18,"type":19},"PAN-OS","product",{"name":21,"type":22},"Palo Alto Networks","vendor",{"name":24,"type":25},"Ransomware-as-a-service","technology","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":26,"icon":28,"name":29,"slug":30},null,"Ransomware","ransomware",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"cve","CVE-2026-0257","Palo Alto Networks PAN-OS authentication bypass vulnerability exploited for initial access.",[21,18],{"controls":56,"vendors":141},[57,84,112],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,69,77],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":58,"product_name":66,"url":67,"description":68},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":78,"vendor_name":21,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":85,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[142,148],{"slug":143,"name":144,"logo_path":145,"roles":146},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[147],"reported_by",{"slug":78,"name":21,"logo_path":79,"roles":149},[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":170},"unpatched-pan-os-flaw-opens-door-to-qilin-ransomware-via-vpn-bypass","Unpatched PAN-OS Flaw Opens Door to Qilin Ransomware via VPN Bypass","Attackers exploited a known authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks PAN-OS to hijack VPN sessions without valid credentials, demonstrating the critical danger of delayed patching on internet-facing infrastructure. Once inside, threat actors harvested credentials, moved laterally across the network, and ultimately deployed Qilin ransomware — a multi-stage attack chain that could have been broken at the very first step. The ransomware-as-a-service model amplifies the risk, as multiple affiliates with varying tactics can exploit the same vulnerability simultaneously. Compounding the damage, attackers deliberately cleared logs and disabled security features, severely hindering detection and incident response efforts. This incident underscores that unpatched perimeter devices are not just a compliance gap — they are an open invitation to catastrophic business disruption.",[156,157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-9: Protection of Audit Information","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.RP-1: Response Plan Executed","ITIL Change Management: Emergency Change Procedures","PCIA (Palo Alto PSIRT Advisory) CVE-2026-0257","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1078: Valid Accounts (Credential Harvesting)","MITRE ATT&CK T1070: Indicator Removal on Host",{}]