Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
Do Son 
| At a glance | |
| Malware family | Qilin, Inc, and Settra ransomware; Cobalt Strike and BloodHound in related activity |
| Threat actors | Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), per Unit 42; Settra per public reporting |
| Targets | Organizations in 11+ sectors, including healthcare, finance, education, and government |
| Delivery vector | Authentication bypass in PAN-OS GlobalProtect portal and gateway |
| Key capabilities | MFA bypass, VPN access, lateral movement, credential theft, ransomware |
| Source | Palo Alto Networks Unit 42 and ReliaQuest |
TL;DR
Ransomware groups are exploiting CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to log in to corporate VPNs. Unit 42 has tied the attacks to Qilin and Inc operators. ReliaQuest also reports Settra ransomware activity and expects attacks to continue.
Delivery
The flaw lets attackers skip login checks on vulnerable GlobalProtect portals and gateways. As a result, they can start a VPN session without valid credentials and get around MFA. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 13, 2026. A public proof of concept followed on May 29.
Infection chain
Once inside, attackers use remote management tools to map the network. Then they move laterally over RDP and SMB. Finally, they stage tools for credential theft, data theft, and ransomware.
In one case, attackers jumped from the VPN to the vCenter appliance. They disabled ESXi security controls and dumped credentials straight from a domain controller’s virtual disk. According to Unit 42, this tactic “bypasses in-guest endpoint detection and response (EDR) and security controls.”
Command-and-control and data exfiltration
ReliaQuest has seen Cobalt Strike, BloodHound, and SharpHound in related intrusions. Because the traffic arrives through the victim’s own VPN, it can look like normal remote work. ReliaQuest warns that it “may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway.”
Attribution to Qilin and Inc comes from Unit 42 investigations. The Settra link rests on public reporting, including ReliaQuest’s threat update on CVE-2026-0257.
Defense and detection guidance
Unit 42’s analysis of active PAN-OS exploitation lists hunting tips. Combined with ReliaQuest’s advice, key steps include:
- Upgrade PAN-OS to a fixed version or apply the vendor workarounds.
- End all active GlobalProtect sessions after patching. Patching alone may not remove existing access.
- Disable authentication override cookies where you do not need them.
- Hunt for VPN sessions with generic device names, placeholder MAC addresses, or hostnames such as “kali.”
- Flag sessions with an empty user domain or a hard-coded Windows 10 Pro OS string.
- Patch Veeam backup servers, since attackers chain CVE-2023-27532 with this access.
Overall, CVE-2026-0257 gives ransomware crews a front door through trusted VPNs. ReliaQuest expects exploitation to continue for at least three months.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
