Arctic Wolf Details Qilin Intrusions Using CVE-2026-0257
Summary
Arctic Wolf Labs details June 2026 intrusions where attackers exploited CVE-2026-0257 in Palo Alto Networks GlobalProtect to deploy Qilin ransomware, steal credentials, move laterally and, in some cases, exfiltrate data.
Key points
- Arctic Wolf Labs investigated multiple June 2026 intrusions in which CVE-2026-0257 exploitation against Palo Alto Networks firewall appliances was identified as the initial access vector.
- The vulnerability affects GlobalProtect portal and gateway authentication under specific configurations; Palo Alto Networks confirmed limited active exploitation on unpatched devices.
- Observed post-access activity included LSASS credential dumping, NTDS extraction, credential-driven lateral movement with PsExec, and broad Windows event-log clearing.
- Qilin payloads were consistently staged as win.exe in C:\PerfLogs or remote Windows temporary directories; some were password-protected and run with the --no-admin flag.
- Some intrusions included data exfiltration before encryption, while others involved encryption without observed data theft; Arctic Wolf says the variation may reflect different Qilin affiliates.
- Overlapping exploitation and VPN-session source IPs, along with systems identifying as kali, suggested shared infrastructure or tooling, but did not establish a single actor.
- Arctic Wolf recommends patching affected systems, reviewing GlobalProtect sessions, rotating credentials if exploitation is suspected, and monitoring for the observed activity.
Article Details
- Attack Vectors
- Attackers exploited CVE-2026-0257 on Palo Alto Networks firewall appliances to bypass GlobalProtect authentication and establish VPN sessions.
- After gaining access, attackers harvested credentials by dumping LSASS memory and extracting the Active Directory database with the NTDSutil Install From Media method.
- Attackers used compromised administrative credentials, PsExec, and Windows administrative shares for lateral movement; RDP was also used in some intrusions.
- Attackers established persistence using a registry Run key and remote-access tools including AnyDesk, Ngrok, and LogMeIn.
- Qilin ransomware was staged as win.exe, commonly under C:\PerfLogs, and executed with a password parameter.
- In some intrusions, attackers exfiltrated data to MEGA before deploying ransomware; other intrusions involved encryption without observed exfiltration.
- Defensive Notes
- Patch CVE-2026-0257 on affected internet-facing Palo Alto Networks appliances and Prisma Access; after patching, terminate active GlobalProtect sessions.
- Consider disabling authentication override options or using dedicated certificates for authentication override cookies.
- Review VPN authentication logs for unexpected source networks, kali or DESKTOP-style hostnames, and multiple internal VPN address assignments from one source.
- If exploitation is suspected or confirmed, rotate domain administrator, KRBTGT, service-account, and relevant cloud-storage credentials.
- Monitor C:\PerfLogs for executable creation and execution, and alert on unusual administrative-share writes, PSEXESVC.exe creation, and widespread Logon Type 3 activity.
- Block or alert on unauthorized AnyDesk, Ngrok, LogMeIn, and Rclone activity, and investigate unusual outbound transfers to MEGA.
- Forward Windows event logs centrally and alert on event-log clearing or security-tool disablement; monitor NTDS.dit access and IFM-related commands.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]61[.]229[.]217 | Reported attacker infrastructure establishing a GlobalProtect VPN session from a system identifying as kali. |
| IPV4 | 108[.]61[.]75[.]232 | Reported attacker infrastructure establishing a GlobalProtect VPN session from a system identifying as kali. |
| IPV4 | 199[.]247[.]22[.]193 | Reported attacker infrastructure establishing a GlobalProtect VPN session from a system identifying as kali. |
| IPV4 | 2[.]188[.]33[.]52 | Reported attacker infrastructure establishing a GlobalProtect VPN session from a system identifying as kali. |
| IPV4 | 70[.]34[.]205[.]43 | Reported attacker infrastructure establishing a GlobalProtect VPN session from a system identifying as kali. |
MITRE ATT&CK
T1003.001 · LSASS MemoryAttackers used rundll32.exe and comsvcs.dll to dump LSASS process memory to a file.T1003.003 · NTDSAttackers used ntdsutil.exe with the Install From Media method to create a copy of the Active Directory database.T1021.002 · SMB/Windows Admin SharesAttackers transferred files through Windows administrative shares such as C$ and used them for lateral movement.T1046 · Network Service DiscoverySoftPerfect Network Scanner was used to identify accessible systems on victim networks.T1070.001 · Clear Windows Event LogsAttackers cleared Windows event logs, including through a routine that enumerated and cleared populated log channels.T1133 · External Remote ServicesAfter exploitation, attackers established GlobalProtect VPN sessions to access victim networks.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-0257 against internet-facing Palo Alto Networks firewall appliances for initial access.T1219 · Remote Access ToolsAnyDesk, Ngrok, and LogMeIn were deployed to provide attackers with remote access.T1486 · Data Encrypted for ImpactQilin ransomware was deployed to encrypt files across victim environments.T1490 · Inhibit System RecoveryAttackers targeted Veeam backup infrastructure before ransomware deployment to eliminate recovery options.T1547.001 · Registry Run Keys / Startup FolderAttackers used a registry Run key with a randomized name to launch the staged ransomware payload.T1562.001 · Disable or Modify ToolsMicrosoft Defender Real-Time Protection was disabled before ransomware deployment in some intrusions.T1567.002 · Exfiltration to Cloud StorageIn some intrusions, Rclone was used to transfer stolen data to MEGA storage infrastructure.T1569.002 · Service ExecutionPsExec service artifacts and remote execution via PsExec were observed during lateral movement.T1572 · Protocol TunnelingNgrok, described as a tunneling utility that exposes local services through public endpoints, was deployed for access.
CVE
Threat Actors
Malware
Vendors
MicrosoftMicrosoft Remote Desktop Protocol (RDP) was used as a secondary lateral movement method.Palo Alto NetworksArctic Wolf Labs found multiple June 2026 intrusions in which attackers used CVE-2026-0257 against Palo Alto Networks firewall appliances to gain VPN access and quickly deploy Qilin ransomware across victim networks.
Products
GlobalProtectAttackers exploited Palo Alto Networks GlobalProtect VPN sessions to bypass authentication.Microsoft Defender Antimalware PlatformMicrosoft Defender Real-Time Protection was disabled prior to ransomware deployment in some cases, reducing the likelihood of payload detection during execution.Microsoft Windowsdumping and NTDS extraction, leveraging compromised administrative accounts to move laterally through Windows administrative shares.PAN-OSCVE-2026-0257 (CVSS Score: 7.8/High) is an authentication bypass vulnerability affecting the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS.Prisma AccessPrisma Access 10.2.0 through 10.2.10-h35, 11.2.0 through 11.2.7-h12
Tools
AnyDeskPsExec, AnyDesk, Ngrok, and LogMeIn were used for lateral movement and persistence.FileZillaFileZilla (FileZilla.exe): an open-source FTP client.LogMeInPsExec, AnyDesk, Ngrok, and LogMeIn were used for lateral movement and persistence.MeshAgentIn one instance, a scheduled task named MeshUserTask was observed, consistent with MeshAgent (an open-source remote management agent) being deployed for persistent access.NetExecAdditionally, NetExec (nxc.exe) was used for network enumeration and credential validation. NetExec is an actively-maintained successor to CrackMapExec commonly used by both penetration testers and threat actors forNgrokPsExec, AnyDesk, Ngrok, and LogMeIn were used for lateral movement and persistence.ProtonDriveProtonDrive (ProtonDrive.exe): the Proton Mail encrypted cloud storage client.PsExecThe activity showed shared operational patterns, including PsExec lateral movement, credential theft, log clearing, and in some cases data exfiltration for double-extortion, suggesting overlapping Qilin affiliates orRCloneRclone (C:WindowsTemprclone.exe): a command-line program for managing and transferring files to cloud storage.SoftPerfect Network ScannerThe SoftPerfect Network Scanner (netscan.exe) was deployed to identify accessible systems on the network.
Industries
Educationover the past twelve months, with affiliates targeting organizations across healthcare, manufacturing, education, government, and professional services sectors globally.Governmenttwelve months, with affiliates targeting organizations across healthcare, manufacturing, education, government, and professional services sectors globally.Healthcareprolific RaaS operations over the past twelve months, with affiliates targeting organizations across healthcare, manufacturing, education, government, and professional services sectors globally.Manufacturingoperations over the past twelve months, with affiliates targeting organizations across healthcare, manufacturing, education, government, and professional services sectors globally.Professional Servicesaffiliates targeting organizations across healthcare, manufacturing, education, government, and professional services sectors globally.