Qilin Group Breaches Networks Through Critical Palo Alto VPN Flaw

Researchers at Arctic Wolf report that the Qilin ransomware group is exploiting a critical authentication-bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks' PAN-OS software. The flaw, tracked as CVE-2026-0257, allows an attacker to bypass security restrictions and establish an unauthorized VPN connection.

Timeline

Palo Alto Networks released a fix on May 13 and warned that attackers had already begun leveraging the hole to break into corporate networks. Rapid7 observed exploitation against numerous customers starting May 17. The U.S. agency CISA added the vulnerability to its catalog of known exploited vulnerabilities on May 29, giving federal agencies three days to protect their GlobalProtect instances.

Qilin's Attacks

On Monday, Arctic Wolf Labs disclosed details of several incidents from June 2026 in which the exploitation of CVE-2026-0257 against Palo Alto Networks firewalls led to domain-wide network encryption by the Qilin ransomware. The post-intrusion tactics varied, however, ranging from rapid encryption to full-blown “double extortion” with data theft. According to the researchers, this indicates that the vulnerability is being exploited by several affiliates at once, operating under the ransomware-as-a-service model.

The analysts assess with medium confidence that such attacks are likely ongoing. This conclusion is based on large-scale scanning activity and on the very nature of the RaaS model, in which successful exploits spread among many participants.

The Scale of the Threat

The Shadowserver monitoring service is tracking more than 167,000 internet-facing GlobalProtect VPN instances, while Shodan has found over 172,000 IP addresses carrying the distinctive GlobalProtect signature. It is unclear, however, how many of these are honeypots or are already protected against the attacks.

The Qilin group emerged in August 2022 under the name “Agenda” and has since claimed responsibility for more than 2,000 victims on its dark-web leak site. Among them are the automotive giants Nissan and Yangfeng, the Japanese brewer Asahi, the pathology-services provider Synnovis, the publishing holding company Lee Enterprises, and Australia's Court Services Victoria.

Palo Alto Networks' products and services are used by more than 70,000 organizations worldwide, including most of the largest U.S. banks and 90% of the Fortune 10.

Source: Bleeping Computer