Qilin and INC Ransomware Groups Exploit Patched Palo Alto Networks Flaw to Bypass MFA
Summary
Palo Alto Networks reports Qilin and INC ransomware actors exploiting patched CVE-2026-0257 to establish unauthorized VPN sessions and bypass MFA, with some activity reaching virtualization infrastructure and domain credentials.
Key points
- CVE-2026-0257 is an authentication-bypass flaw affecting PAN-OS and Prisma Access that can enable unauthorized VPN connections; Palo Alto Networks patched it in May 2026.
- Unit 42 says Qilin and INC ransomware operators have exploited the flaw to gain initial access and establish VPN sessions despite MFA.
- In one reported case, attackers moved from a compromised VPN gateway to vCenter, disabled an ESXi security control, and used a custom tool to dump credentials from a domain controller’s virtual disk.
- The attackers’ activity has targeted organizations across multiple sectors, including healthcare, finance, government, manufacturing, and utilities.
- Palo Alto Networks recommends applying the latest fixes, proactively hunting for indicators of compromise, and initiating incident response when successful gateway-connected events are detected.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- CVSS 7.8
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1003.003 · NTDSA custom tool was used to dump credentials offline from a domain controller's virtual disk.T1133 · External Remote ServicesThe actors exploited the flaw to establish unauthorized VPN sessions and gain an initial foothold in corporate networks.T1562.001 · Disable or Modify ToolsThe actors disabled the execInstalledOnly security control on ESXi hypervisors.
CVE
CVE-2023-27532Attackers have also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws (CVE-2023-27532) to inflict maximum damage.CVE-2026-0257The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and
Threat Actors
INCAn INC ransomware group reported to be actively exploiting CVE-2026-0257; Unit 42 identifies Tarnished Scorpius as an alias.QilinA ransomware group reported to be actively exploiting CVE-2026-0257; Unit 42 identifies Spikey Scorpius as an alias.SettraReliaQuest reported that the Settra ransomware group was actively exploiting CVE-2026-0257.
Vendors
Palo Alto NetworksPalo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.VeeamAttackers have also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws (CVE-2023-27532) to inflict maximum damage.
Products
ESXiVPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directlyPAN-OSPalo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.Prisma AccessPalo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.VeeamAttackers have also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws (CVE-2023-27532) to inflict maximum damage.VMware vCenter Server"In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to
Industries
EducationAttacks mounted by these groups are said to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services,Financial Servicesmounted by these groups are said to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services,Governmentservices, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.Healthcaregroups are said to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government,High Techsaid to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation andHospitalitya wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilitiesManufacturingrange of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, andProfessional and legal serviceseducation, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.Retailprofessional and legal services, government, transportation and logistics, utilities and energy, and retail.Transportation and Logisticshigh technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.Utilities and energymanufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.