Executive Summary
Palo Alto Networks' Unit 42 has observed the Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) ransomware groups exploiting a critical authentication bypass vulnerability, CVE-2026-0257, in PAN-OS and Prisma Access. Despite a patch being available since May 2026, threat actors continue to utilize this flaw to establish unauthorized VPN connections and bypass multi-factor authentication (MFA).
The attack chain involves moving from compromised VPN gateways directly to the virtualization management layer, specifically targeting VMware vCenter and ESXi hosts. By disabling security settings such as execInstalledOnly, attackers are performing offline credential dumping from domain controller virtual disks (VMDKs). This allows them to bypass traditional guest OS security controls.
This campaign represents a significant risk to organizations across diverse sectors including finance, healthcare, and manufacturing. The shift toward hypervisor-level deployment allows ransomware operators to impact all virtual machines managed by a single vCenter appliance, greatly increasing the scale and speed of business disruption.