Threat actors are actively exploiting a known authentication bypass vulnerability in Palo Alto Networks PAN-OS to gain unauthorized access to enterprise networks before deploying Qilin ransomware, according to new incident response findings published by Arctic Wolf Labs. The research provides one of the clearest pictures yet of how attackers are turning an edge-device vulnerability into full-scale domain compromise and ransomware deployment.
Unlike earlier reports that primarily documented exploitation attempts against exposed GlobalProtect gateways, Arctic Wolf’s investigation follows the attack chain beyond the initial compromise. The company analyzed multiple ransomware incidents throughout June 2026 where the same vulnerability served as the initial access vector before attackers established persistence, stole credentials, moved laterally across Active Directory, exfiltrated data, and ultimately encrypted victim systems using Qilin ransomware.
The findings highlight an increasingly common pattern in enterprise attacks. Rather than relying on phishing emails or stolen VPN credentials, ransomware operators are abusing vulnerabilities in internet-facing security appliances themselves. Once a trusted VPN session is established, the firewall effectively becomes the attacker’s front door.
CVE-2026-0257 Explained
The attacks exploit CVE-2026-0257, an authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS.
The vulnerability does not simply bypass passwords through brute force or credential theft. Instead, it abuses the implementation of authentication override cookies, a feature designed to reduce repeated authentication prompts for legitimate users.
When deployed in a vulnerable configuration, PAN-OS trusts any authentication override cookie that it can successfully decrypt without adequately verifying whether that cookie was legitimately issued by the firewall itself. If administrators reuse the same certificate for both the publicly exposed GlobalProtect HTTPS service and authentication override cookie encryption, an attacker can obtain the certificate information exposed by the HTTPS service and generate forged authentication cookies that appear completely legitimate. The firewall subsequently accepts these forged cookies and establishes an authenticated VPN session without requiring valid credentials or multi-factor authentication.
Successful exploitation requires three conditions:
- GlobalProtect Portal or Gateway is enabled.
- Authentication Override Cookies are enabled.
- The authentication override certificate is reused or otherwise publicly exposed instead of being dedicated exclusively to cookie encryption.
Authentication override cookies are not enabled by default, meaning not every exposed GlobalProtect deployment is vulnerable. However, organizations that enabled the feature for user convenience while reusing certificates became exposed to unauthenticated VPN access.
The issue affects multiple PAN-OS releases, including vulnerable builds of:
- PAN-OS 10.2
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 12.1
- Certain Prisma Access deployments
Cloud NGFW and Panorama are not affected by this vulnerability. Fixed software versions are available from Palo Alto Networks.
From Medium Severity to Active Exploitation
When Palo Alto Networks initially disclosed CVE-2026-0257 in May 2026, the vulnerability received a relatively modest severity assessment. That quickly changed after Rapid7 published technical analysis and demonstrated successful exploitation.
Real-world attacks had already begun by May 17, prompting Palo Alto Networks to increase the severity rating to CVSS 7.8 while the vulnerability was simultaneously added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Rapid7 independently confirmed exploitation against multiple customer environments, while Palo Alto acknowledged limited active exploitation against unpatched systems.
Those early observations primarily showed attackers establishing unauthorized VPN sessions. Arctic Wolf’s latest investigation demonstrates what happens after attackers successfully enter a network.
How the Intrusions Unfolded
Across multiple incident response engagements, Arctic Wolf observed remarkably consistent initial access followed by more variable post-exploitation activity.
After forging GlobalProtect authentication cookies, attackers established legitimate-looking VPN connections directly into victim environments. Since these sessions appear as authenticated VPN logins, perimeter defenses often view the connection as trusted.
Once inside, attackers rapidly transitioned from initial access to persistence.
Windows Registry Run keys were created using an unusual naming convention consisting of an asterisk followed by six randomly generated lowercase characters. This persistence mechanism allowed malware and remote administration tools to survive system reboots while blending into normal registry entries.
Rather than relying on a single remote access utility, operators deployed several legitimate administration tools simultaneously, including AnyDesk, Ngrok, and LogMeIn. Maintaining multiple remote access channels provides redundancy if defenders detect and remove one access method.
Credential theft followed almost immediately.
Investigators observed attackers using the well-known Windows technique of invoking rundll32.exe together with comsvcs.dll to dump the LSASS process. Instead of storing the resulting credential dump with an obvious filename, the attackers disguised it using an .odt extension, likely attempting to avoid casual inspection or simplistic detection rules focused on memory dump extensions.
With privileged credentials obtained, attackers escalated their campaign further by extracting the organization’s Active Directory database using ntdsutil.exe. Obtaining NTDS.dit enables offline extraction of password hashes and effectively gives attackers access to credentials across the entire Windows domain.
Lateral movement then relied on familiar administrative utilities.
Investigators observed widespread use of PsExec together with administrative SMB shares such as C$ to distribute tooling and execute commands across additional systems. These techniques remain popular because they leverage legitimate Windows administration functionality that already exists inside enterprise environments.
Different Affiliates, Same Entry Point
Although the initial compromise technique remained largely identical, Arctic Wolf observed significant variation in what happened afterward.
Some intrusions progressed directly from VPN access to ransomware deployment with very little dwell time. Other compromises involved lengthy reconnaissance, privilege escalation, widespread credential theft, Active Directory mapping, and data exfiltration before encryption ever began.
Several incidents included the use of Rclone to transfer stolen data into MEGA cloud storage prior to launching ransomware. This reflects the increasingly common double-extortion model where attackers threaten to publish stolen information even if organizations restore from backups.
Such operational differences are consistent with Ransomware-as-a-Service (RaaS) operations like Qilin, where multiple affiliates share infrastructure, ransomware payloads, and exploits while retaining considerable freedom in post-compromise tactics.
Anti-Forensics Before Encryption
Immediately before ransomware execution, attackers consistently attempted to reduce forensic visibility. Microsoft Defender Real-Time Protection was disabled to reduce the likelihood of malware detection.
Investigators also recovered PowerShell scripts designed to clear every Windows Event Log channel, not merely the Security or System logs. Removing all event logs substantially complicates incident response by eliminating valuable evidence of attacker activity.
The ransomware executable itself was consistently staged as:
C:\PerfLogs\win.exe
The PerfLogs directory is a legitimate Windows folder intended for performance logging. Because it receives comparatively little attention from many monitoring solutions, threat actors frequently abuse it as a staging location.
Arctic Wolf additionally observed that execution required a password argument, making automated sandbox analysis more difficult because simply launching the executable does not trigger encryption without the correct parameter.
Infrastructure Observations
Arctic Wolf noted several operational characteristics that appeared repeatedly across investigated incidents.
Multiple compromised systems identified themselves using the hostname:
kali
The researchers also identified overlapping IP addresses between the initial exploitation activity and subsequent VPN sessions, suggesting shared attacker infrastructure or common tooling among Qilin affiliates.
While these observations may assist defenders during investigations, hostnames alone should not be considered reliable attribution evidence because they are easily modified by attackers.
Indicators of Compromise (Observed and Published)
The following indicators have been publicly associated with confirmed exploitation activity by Rapid7, Palo Alto Networks, and Arctic Wolf.
Observed Source IP Addresses
104.207.144[.]154146.19.216[.]119146.19.216[.]120146.19.216[.]125209.99.191[.]13779.130.26[.]202146.70.165[.]52216.238.74[.]9864.190.113[.]15123.128.228[.]6179.43.172[.]213185.195.232[.]139198.12.106[.]60202.144.192[.]47
These addresses have been observed during exploitation or successful GlobalProtect authentication events. Organizations should treat them as historical indicators suitable for retrospective hunting rather than permanent blocking rules, since attacker infrastructure can change over time.
Suspicious Hostnames and Device Identifiers
kaliGP-CLIENTDESKTOP-GP01Jocker
These names appeared in observed exploitation activity or authenticated GlobalProtect sessions.
Suspicious MAC Address
aa:bb:cc:dd:ee:ff
Rapid7 observed this spoofed MAC address across multiple exploitation waves.
Files and Paths
C:\PerfLogs\win.exe
Windows Utilities Observed
rundll32.execomsvcs.dllntdsutil.exePsExecPowerShell
Remote Access Tools
AnyDeskNgrokLogMeInRcloneMEGA
Registry Persistence Pattern
HKCU\Software\Microsoft\Windows\CurrentVersion\RunHKLM\Software\Microsoft\Windows\CurrentVersion\RunValue Name Pattern:*xxxxxx
where xxxxxx represents six random lowercase letters.
Detection Opportunities
Organizations operating GlobalProtect should review authentication logs for successful VPN sessions that exhibit unusual characteristics, particularly cookie-based authentications originating from cloud hosting providers or unfamiliar geographic locations.
Security teams should also investigate:
- Successful GlobalProtect logins immediately followed by privileged Windows authentication activity.
- Unexpected execution of
rundll32.exewithcomsvcs.dll. - Use of
ntdsutil.exeon systems that are not domain controllers performing maintenance. - Creation of executables within
C:\PerfLogs. - Execution of AnyDesk, Ngrok, LogMeIn, or Rclone on servers where those tools are not normally installed.
- PowerShell activity clearing multiple Windows Event Log channels.
- PsExec activity originating from newly established VPN sessions.
- Registry Run values beginning with an asterisk followed by random lowercase characters.
Mitigation and Response
Organizations should prioritize remediation if they operate affected PAN-OS or Prisma Access deployments exposed to the internet.
Patch all affected systems to fixed software versions published by Palo Alto Networks and verify that authentication override cookies are disabled unless there is a documented business requirement. If authentication override must remain enabled, organizations should use a dedicated certificate that is never reused by any publicly accessible service.
If compromise is suspected, simply applying patches is insufficient because attackers may already possess authenticated VPN access or stolen domain credentials.
Incident response should include terminating every active GlobalProtect session, resetting privileged credentials, rotating domain administrator passwords, resetting the KRBTGT account if domain compromise is confirmed, reviewing persistence mechanisms, and preserving centralized log data for forensic analysis. Organizations that forward Windows Event Logs into a SIEM retain evidence even if attackers successfully erase local event logs.
Final Thoughts
The latest Arctic Wolf investigation demonstrates that CVE-2026-0257 has evolved beyond opportunistic internet scanning into a reliable initial access technique for ransomware operators. Rather than exploiting a flaw inside Windows itself, attackers are abusing trusted VPN infrastructure to obtain what appears to be legitimate remote access before executing a conventional ransomware playbook involving credential theft, Active Directory compromise, lateral movement, data exfiltration, anti-forensics, and ultimately Qilin ransomware deployment.
For defenders, the lesson extends beyond this single vulnerability. Internet-facing security appliances increasingly represent high-value targets because compromising them can eliminate the need for phishing, credential theft, or malware-based initial access altogether. Organizations operating exposed VPN infrastructure should treat vulnerabilities in these systems with the same urgency as remote code execution flaws, particularly once active exploitation has been confirmed in the wild.
