Ransomware Crews Turn PAN-OS GlobalProtect Bypass Into a Path to Hypervisors

Palo Alto Networks' Unit 42 threat research team says ransomware operators are still exploiting CVE-2026-0257. The flaw is an authentication bypass in PAN-OS and Prisma Access that lets attackers open unauthorized VPN connections. In an update to its threat brief, labelled October 19 and revised on October 20, Unit 42 named two groups behind the activity: Spikey Scorpius, better known as Qilin, and Tarnished Scorpius, known as INC. The vendor also described a worrying change in how the attackers behave once they are inside a network. In at least one case, they went straight for the virtualization layer that hosts an organization's servers.

What happened

The timeline below is assembled from Unit 42's brief and reporting by The Hacker News.

• May 2026: Palo Alto Networks released a fix for CVE-2026-0257. On May 13, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. KEV is CISA's list of bugs confirmed to be used in real attacks.
• Early exploitation: Unit 42 first saw an unidentified actor trying to reach GlobalProtect, the company's VPN service. At that stage only a small share of probed devices actually ended up with an established VPN session. The brief said no follow-on activity or lateral movement had been seen at the time.
• May 29, 2026: A public proof-of-concept (PoC) was released. A PoC is demonstration code showing that a flaw can be exploited. Unit 42 split its detection guidance into activity before and after this date.
• Early June 2026: According to the brief, Unit 42's incident response investigations into the post-exploitation activity began around this time.
• July 2026: Arctic Wolf reported that Qilin was exploiting the flaw. It described attacks ranging from quick encryption-only operations to full "double extortion," where data is stolen as well as encrypted.
• October 2026: A few days before Unit 42's latest update, ReliaQuest said it had seen both Qilin and the Settra ransomware group exploiting the vulnerability for financial gain. Unit 42 then named Qilin and INC as active exploiters. It acknowledged the public reporting on Settra but did not confirm that attribution itself.

Who is affected

The vulnerability sits in the GlobalProtect portal and gateway components of vulnerable PAN-OS versions. The Hacker News also lists Prisma Access, Palo Alto Networks' cloud-delivered security service, as affected. Neither source names specific affected or fixed version numbers. Administrators should check the official Palo Alto Networks security advisory for CVE-2026-0257 to find out whether their builds are affected.

The victims span many industries. The Hacker News lists education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. Neither source breaks the activity down by country or region.

How it works

GlobalProtect lets remote employees connect securely to their company network through a VPN, an encrypted tunnel across the internet. Normally a user must prove who they are first, often with multi-factor authentication (MFA), meaning a second check such as a phone prompt on top of a password.

CVE-2026-0257 breaks that gatekeeping. Unit 42 says a flaw in the portal and gateway lets unauthorized attackers sidestep the security controls and start a VPN connection, MFA included. To the network, the attacker then looks like a remote worker who has logged in.

Unit 42 and The Hacker News describe a familiar pattern of activity after that first step:

• Reconnaissance: mapping the internal network with remote monitoring and management (RMM) tools. These are legitimate IT admin utilities that criminals also abuse, which is why they are called "dual-use."
• Lateral movement: spreading to other machines over RDP (Windows Remote Desktop) and SMB (Windows file sharing).
• Staging: bringing in extra tools to steal passwords, copy data out and finally deploy ransomware.

The new element is the move against virtualization. Unit 42 calls this the "direct pivot to the virtualization layer." In one case, attackers went from the compromised VPN gateway to vCenter, the console used to manage VMware ESXi hypervisors. A hypervisor is the software that runs many virtual servers on one physical machine. The attackers switched off an ESXi security setting called execInstalledOnly, which normally limits the hypervisor to running approved software. They then used a custom tool to pull credentials offline from the virtual disk file (VMDK) of a domain controller, the server that manages logins across a Windows network.

The approach works because it reads the server's disk from outside the virtual machine. Endpoint detection and response (EDR) software running inside that machine never sees it happen. The result is credentials that work across the whole domain. The Hacker News adds that attackers have chained this access with other exploits, including attacks on Veeam backup systems through the older flaw CVE-2023-27532. Backups are what victims rely on to recover without paying, so they are a natural target.

How serious is it?

The Hacker News reports a CVSS score of 7.8, which falls in the "high" band. Unit 42's brief, as provided, does not give a score, and no independently verified CVE record was available for this article. Readers should confirm the rating in the vendor advisory.

The score alone understates the real-world risk. The flaw is confirmed as exploited, is listed in CISA's KEV catalog, has a public PoC, and is being used by at least two established ransomware operations. A further group, Settra, is linked to it by ReliaQuest's reporting.

The sources use slightly different language. The Hacker News describes continued exploitation. Unit 42's October update speaks of continued "attempted exploitation," while also documenting confirmed intrusions that led to ransomware staging. The brief's earlier statement that no post-access activity had been seen is now clearly out of date, since later sections describe extensive lateral movement. Unit 42 also flags a related misconfiguration from its "Lunar Peak" incident response work. Many organizations had mapped GlobalProtect profiles to HTTP/HTTPS services on their management interfaces. This quietly exposed those interfaces to the internet on ports 4443 and 3879, often without administrators realizing it.

What to do now

For administrators:

• Read the Palo Alto Networks advisory for CVE-2026-0257. Upgrade PAN-OS and check Prisma Access to a fixed version, or apply the listed workarounds until you can.
• Search GlobalProtect logs for successful "gateway-connected" events matching the indicators in Unit 42's brief. These include suspicious IP addresses from before the PoC's release, unusual host IDs or device names, and hard-coded client values from the PoC, such as an endpoint OS string of "Microsoft Windows 10 Pro 64-bit."
• Treat any matching successful connection as a possible breach and start incident response. Patching does not remove an attacker who is already inside.
• Check whether your management interface is reachable from the internet. From outside your network, try an HTTPS connection to the management IP on ports 4443 and 3879. If it responds, tighten your Interface Management profiles following vendor guidance.
• Review vCenter and ESXi for unexpected logins and confirm that execInstalledOnly is still enabled.
• Patch Veeam against CVE-2023-27532 and make sure backups are isolated from the main network.
• Watch for unexpected RMM tools and unusual RDP or SMB traffic coming from VPN address ranges.
• If you use Cortex Xpanse, use it to list your internet-facing PAN-OS gateways and GlobalProtect portals.

For everyday users:

• Install VPN client updates when IT asks you to.
• Report unexpected MFA prompts, password reset notices or odd behavior on work systems straight away.
• Be wary of anyone asking you to install remote access tools, even if they say they are from IT.

What we still don't know

• Which exact PAN-OS and Prisma Access versions are vulnerable and which are fixed. The sources do not list them.
• How many organizations have been breached, and how many have suffered ransomware as a result.
• Who was behind the early, unattributed exploitation before the PoC was published.
• Whether Unit 42 will independently confirm the Settra attribution.
• What the custom VMDK credential-dumping tool is, and whether it is shared between groups.
• Which countries or regions are most affected.

ITVedas analysis: Edge VPN devices remain the easiest way into corporate networks. The move from a gateway bug to the hypervisor shows that attackers now aim to get around EDR rather than fight it. Patching closes the door, but any organization that ran a vulnerable GlobalProtect gateway after May should assume compromise until its logs show otherwise.