Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Summary: Arctic Wolf Labs investigated multiple June 2026 intrusions that began with exploitation of CVE-2026-0257, a high-severity (CVSS 7.8) PAN-OS authentication bypass that lets unauthenticated remote attackers establish SSL VPN sessions when authentication override cookies are enabled with specific certificate configurations. Attackers then deployed Qilin (Agenda) ransomware, staging payloads at C:\PerfLogs\, using PsExec for lateral execution via administrative shares, disabling Microsoft Defender Real-Time Protection, and clearing event logs, with tradecraft ranging from encryption-only to double-extortion with exfiltration to MEGA via Rclone, Proton Drive, and FileZilla.
What's compelling: A single authentication bypass on the VPN gateway handed attackers authenticated access, and the variation Arctic Wolf saw across intrusions - from rapid encryption to full data theft - points to multiple Qilin affiliates sharing the same initial-access infrastructure, so the same flaw can produce very different levels of damage at different victims.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2026-0257
- Related
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) Cyber Risks · Oct 20, 2026CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 29, 2026