Summary
- Unit 42 links exploitation of CVE-2026-0257 to ransomware operators including Qilin and Inc.
- The flaw affects GlobalProtect portals and gateways, allowing unauthorised VPN connections.
- In at least one case investigators observed a pivot towards vCenter and ESXi systems.
Ransomware operators including Qilin and Inc have exploited an authentication bypass in Palo Alto Networks PAN-OS software, according to an updated Unit 42 investigation that documents access to internal networks and, in one case, subsequent movement into virtualisation infrastructure. The activity concerns CVE-2026-0257 in GlobalProtect, rather than a different PAN-OS management interface flaw disclosed more recently.
Unit 42’s 19 October ransomware findings, supplemented with updated exposure guidance on 20 October, identify actors it tracks as Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Public reporting cited by the researchers has additionally linked activity to Settra ransomware. The researchers have investigated incidents across multiple sectors since early June, but have not named a total number of confirmed compromised organisations.
CVE-2026-0257 affects the authentication boundary for vulnerable GlobalProtect portal and gateway deployments. Successful exploitation can allow an unauthorised attacker to establish a VPN session without passing the expected controls. The distinction is important because a VPN connection places the attacker on a path into internal systems; it does not mean every available host is automatically compromised.
Unit 42 says observed follow-on activity included network reconnaissance, use of remote management utilities, credential harvesting and attempts to move laterally with established Windows networking protocols. These are common post-access techniques, but the entry point through a security product changes the initial assumptions an organisation may make about where authenticated network activity is originating.
Virtualisation extends the consequences of a compromised gateway
One investigated incident involved movement from a GlobalProtect environment into the vCenter management appliance used to administer VMware virtualisation. Unit 42 says attackers disabled security controls on ESXi hypervisors and used a specialised tool to obtain credentials from a domain controller virtual disk. Such activity can bypass security products running inside a guest operating system, because the attacker is working through the management layer beneath it.
That progression can turn an initial VPN access event into a broader identity problem. Compromise of credentials associated with domain controllers or central virtualisation services has consequences for multiple systems hosted on the same platform. Unit 42 also reports attempts to combine this activity with exploitation of backup infrastructure, including Veeam-related weaknesses, although these combinations were not shown to occur in every case.
The investigation includes sectors such as finance, healthcare, manufacturing, transport, energy and government. These categories indicate the types of organisations encountered during response work, not a quantified distribution of successful attacks or a list of European victims. Unit 42 has not given a breakdown sufficient to claim that a particular national critical infrastructure operator was compromised.
Unit 42 says a small proportion of initially probed devices produced confirmed VPN gateway connection events in its earlier observations. Its updated report establishes subsequent ransomware-associated operations, meaning the publicly documented threat has progressed beyond reconnaissance in at least some environments. The vulnerability was already publicly documented and fixed earlier in 2026; the new reporting concerns exploitation and post-access consequences.
The vendor has supplied indicators and guidance to distinguish probing from successful sessions, and recommends examining deployment configuration and upgrading affected PAN-OS versions. In separate advice, it highlights instances where management interface services were unintentionally exposed through GlobalProtect profile configuration. That issue can worsen exposure but should not be conflated with the specific authentication bypass itself.
Investigators also identify a distinction between a connection attempt and a successful tunnel. Authentication bypass probes may leave records that indicate testing rather than established access; a confirmed gateway-connected event deserves a different incident response assessment. Because ordinary remote administration utilities can be used legitimately, their presence alone is not evidence of ransomware. Unit 42’s conclusions draw on sequences of network behaviour observed during investigations, including post-access movement, rather than a single generic indicator. The public brief provides detection context but does not replace organisation-specific forensic findings.
Unit 42’s account now includes ransomware involvement and a documented route towards hypervisor-level compromise. The extent of any data theft or encrypted systems depends on each investigation, and the company has not publicly established a single campaign-wide damage figure.
