Qilin Ransomware Exploits PAN-OS Authentication Bypass

In June 2026, Arctic Wolf Labs identified multiple intrusions where Qilin ransomware affiliates exploited CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway components. This flaw allows unauthenticated attackers to establish VPN sessions, providing a direct foothold into victim environments. Once inside, attackers leveraged compromised administrative credentials to perform wide-scale internal reconnaissance and lateral movement.

The campaigns exhibited variability in post-exploitation tradecraft, ranging from rapid encryption-only attacks to complex double-extortion scenarios involving data exfiltration to MEGA cloud storage. Despite these differences, consistent operational patterns were observed, including the staging of ransomware in specific directories and the use of legitimate administrative tools like PsExec for distribution. This activity underscores the significant risk posed by unpatched perimeter appliances and the professionalized nature of the Qilin RaaS ecosystem.