By Hamza Faisal

The VPN is supposed to be the front door — and right now, ransomware gangs have found a way to walk straight through it without even knocking.

Palo Alto Networks' threat intelligence arm, Unit 42, says two ransomware operations — Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (Tarnished Scorpius) — are actively exploiting CVE-2026-0257, an authentication bypass flaw in the company's GlobalProtect VPN and Prisma Access platforms. The flaw lets an attacker open a fully authorized VPN connection with no username, no password, and no multi-factor authentication challenge at all.

That is not a theoretical weakness: the bug was patched in May 2026, yet five months later it remains a live weapon. ReliaQuest separately confirmed on Oct. 9 that Qilin and a second operation called Settra were actively exploiting the same flaw, and Unit 42 says exploitation is still being observed this week.

How the attack works

The technique is unsettlingly simple. The vulnerability lets attackers forge a GlobalProtect authentication override cookie — the mechanism meant to let already-authenticated users reconnect quickly. With a forged cookie, the gateway validates the intruder as a legitimate remote user and hands over a full VPN session. ReliaQuest says the root cause is that the appliance decrypts the cookie with a configured private key and then trusts its contents implicitly, with no signature check of any kind — so anyone holding the matching public key material can forge a cookie carrying arbitrary user information, including administrative accounts.

Once inside, the gangs behave like any remote employee — which is exactly what makes the intrusion hard to spot. Unit 42 says the attackers run internal reconnaissance with dual-use remote monitoring and management (RMM) tools, move laterally across the network via RDP and SMB, and stage tooling for credential harvesting, data exfiltration, and ultimately ransomware deployment. Cobalt Strike, BloodHound and SharpHound have all been observed in these attack chains.

One case stood out even to Unit 42's researchers. In it, the attackers pivoted directly from the compromised VPN gateway into the organization's vCenter management appliance, disabled security controls on ESXi hypervisors, and used a custom tool to dump credentials offline from a domain controller's virtual disk. That approach sidesteps in-guest endpoint detection and response (EDR) entirely — and handed the attackers domain-wide credentials.

Patching is the answer, and it still isn't done

The flaw, rated 7.8 out of 10 in severity by Palo Alto (the U.S. National Vulnerability Database enrichment team scored it a critical 9.1), was disclosed on May 13, 2026, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog that same month. Fixes were released five months ago.

And yet the attacks keep coming. Arctic Wolf flagged Qilin's exploitation of the same flaw back in July, and Unit 42's latest update says the victim list spans a dozen sectors — education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. In some cases, attackers have chained the VPN flaw with known flaws in Veeam backup infrastructure to inflict maximum damage, wiping out the backups before the ransomware detonates.

Palo Alto Networks is urging organizations to apply the latest fixes, hunt for indicators of compromise, and start incident response if they spot successful gateway-connected events they cannot account for. Security researchers note that well over 100,000 GlobalProtect portals remain publicly reachable months after the patch — so the front door is still wide open in far too many places.

By Hamza Faisal