Qilin ransomware and CVE-2026-0257: the VPN bug is only the front door

On Monday, CISA confirmed that a Palo Alto Networks GlobalProtect authentication bypass — CVE-2026-0257, disclosed on 13 May and scored a merely-"High" 7.8 — is now being used in ransomware campaigns. A day later, Arctic Wolf Labs published its analysis of multiple June intrusions where the same bug carried attackers from a VPN portal to enterprise-wide encryption. The affiliate operating the payload was Qilin — a ransomware-as-a-service crew that, per BleepingComputer, has listed more than 2,000 victims on its leak site since August 2022.

The number that should worry you is not the CVSS. It is the exposure count: Shadowserver tracks over 167,000 GlobalProtect instances reachable from the internet, and Shodan fingerprints over 172,000. This is not a niche appliance. It is one of the most common ways an enterprise terminates remote access, and a two-month-old "High" just became the cheapest initial-access broker on the market.

The bug that a version number doesn't close

CVE-2026-0257 is not a memory-corruption spectacular. It is a logic flaw in how GlobalProtect handles authentication override cookies. When a portal or gateway is configured to issue those cookies and pairs them with a specific certificate configuration, an unauthenticated attacker can forge the cookie, bypass the login, and establish a VPN session as if they had valid credentials. No password, no MFA prompt, no brute force. The CVSS 4.0 vector Palo Alto published — AV:N/AC:L/AT:N/PR:N/UI:N — says exactly this: network reachable, low complexity, no privileges, no user interaction.

The detail that keeps this alive months after the patch is that the fix and the exposure live in two different places. We wrote about this in our earlier analysis of the cookie-forge mechanics: a fully updated PAN-OS firewall is still exploitable if the GlobalProtect portal reuses its TLS certificate for the override cookie. Palo Alto's own remediation is a configuration change — use a dedicated certificate for authentication override, or disable override entirely — not just a firmware bump. Rapid7 observed exploitation within days of the advisory; 8 of 10 of their MDR customers under attack had unauthorized VPN connections established before the activity was contained.

That was in May. The ransomware crews took the summer to industrialize it.

Qilin ransomware: the kill chain after the VPN session

Here is where the "7.8 High" framing collapses. A score describes the vulnerability. It does not describe what the vulnerability is a door to. Arctic Wolf reconstructed the post-access tradecraft across the June intrusions, and it reads like a textbook double-extortion playbook running at speed:

• Persistence was planted immediately — Registry Run keys following a *[a-z]{6} naming pattern, scheduled tasks, and a rotating kit of legitimate remote-access tools: AnyDesk, Ngrok, LogMeIn, MeshAgent. If the VPN hole gets closed, the operators keep a way back in.
• Credential access came from LSASS memory dumping via rundll32.exe calling comsvcs.dll, and from full Active Directory database theft using the ntdsutil.exe IFM (Install-From-Media) method — a single command that snapshots NTDS.dit and the SYSTEM hive, handing the attacker every domain hash at once.
• Lateral movement used PsExec over administrative shares (C$), RDP, and NetExec — living-off-the-land, nothing that pings a signature.
• Defense evasion meant enterprise-wide event-log clearing and disabling Microsoft Defender before the payload ran.
• Exfiltration, in the double-extortion cases, was Rclone streaming to MEGA cloud storage.
• Encryption was win.exe, staged at C:\PerfLogs\ and password-protected so that even a recovered sample resists analysis.

"Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service umbrella." — Arctic Wolf Labs, 20 July 2026

That variance is the tell. This is not one actor with one runbook. It is a rented capability, and the initial-access step — the VPN bypass — is the interchangeable part. Different affiliates, same front door.

Why the wire sees what the endpoint misses

The uncomfortable pattern in ransomware post-mortems is that the victim almost always finds out after the files are locked. The encryption note is the alert. Everything upstream of it — the LSASS dump, the ntdsutil snapshot, the PsExec fan-out, the multi-gigabyte Rclone upload — happened in a window where the network was screaming and nobody was reading the wire in real time.

Consider what each stage of the Qilin chain actually looks like as traffic, independent of any endpoint agent:

Kill-chain stage	Endpoint-agent visibility	Network / traffic visibility
GlobalProtect auth bypass (T1190)	None — the session is "valid"	A VPN session with no preceding authentication exchange
LSASS dump (T1003.001)	High if the agent is running and not disabled	Usually local; little on the wire
NTDS IFM theft (T1003.003)	Detectable via ntdsutil telemetry	DC replication-like reads from an unexpected host
Lateral movement (T1021.001/.002)	Per-host, easily blinded by log clearing	SMB/RDP fan-out from one internal host to many — a shape, not a signature
Defender disabled + logs cleared (T1562.001/T1070.001)	The agent that would report this is the thing being killed	The endpoint goes quiet on the wire at the same instant its peers stay chatty
Rclone → MEGA exfil (T1567.002)	Depends on DLP coverage	Sustained outbound TLS to a never-seen cloud ASN from a host that historically only ingests
win.exe encryption (T1486)	The ransom note	Rapid SMB write bursts to file shares in a predictable lateral pattern

Two rows matter most. When the attacker clears logs and kills Defender, the endpoint's own testimony is destroyed at exactly the moment you need it — but a host that suddenly goes silent while its neighbours keep talking is itself an anomaly the network can see. And the Rclone egress is the loudest event in the entire chain: a workstation or file server that has spent its whole life receiving data suddenly opening a sustained, high-volume TLS tunnel to an ASN it has never contacted. That is not a subtle signal. It is only invisible if nothing is watching packets while it happens.

Remediation

CVE-2026-0257 is the entry point; the Qilin chain is what you inherit if you get it wrong. Treat both.

1. Am I affected? Two questions, in order. First, is your PAN-OS train patched? Check the running version against Palo Alto's fixed list below. Second — and this is the one audits miss — is authentication override configured with a shared certificate? In the web UI, inspect Network → GlobalProtect → Portals/Gateways → Agent → Authentication, and check whether Authentication Override is enabled and which certificate it uses. Externally, enumerate your own exposure the way the attackers do: search Shodan/Censys for your public ranges with a GlobalProtect fingerprint.

2. Patch — exact fixed versions. Per the Palo Alto advisory, upgrade to at least:

• PAN-OS 12.1: 12.1.4-h6 or 12.1.7
• PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12
• PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15
• PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6
• Prisma Access: 11.2.7-h13 (11.2) / 10.2.10-h36 (10.2). Cloud NGFW is unaffected.

3. Can't patch immediately? Change the config. The patch is not the only lever, because the exposure is configuration-driven. Palo Alto's stated mitigations are to use a dedicated certificate for authentication override cookies or to disable authentication override entirely (uncheck the option in the Portal/Gateway agent config). Either one closes the forgery path independently of the firmware version. Do this today even if the upgrade is scheduled for next week.

4. Hunt for compromise (map to MITRE ATT&CK). Assume the VPN was a door, not a wall. Look for:

• T1190 / T1133 — GlobalProtect sessions with no corresponding authentication event; sessions from residential or hosting-provider ASNs your users don't originate from.
• T1547.001 / T1053.005 — new Registry Run keys matching *[a-z]{6}; scheduled tasks masquerading as updaters.
• T1219 — AnyDesk, Ngrok, LogMeIn, MeshAgent processes on servers that have no business running remote-access software.
• T1003.001 / T1003.003 — rundll32.exe loading comsvcs.dll against lsass; ntdsutil.exe invoked with ifm / create full; DC-like replication reads from a non-DC host.
• T1021.001 / T1021.002 — PsExec service creation over C$; RDP or SMB fan-out from a single internal host to many.
• T1562.001 / T1070.001 — Defender tampering; Security event log cleared (Event ID 1102).
• T1567.002 — Rclone command lines; sustained outbound TLS to MEGA or other consumer cloud storage from a server.

5. Eradicate and verify. If you find any of the above, a firewall patch does not clean it. NTDS theft means every domain credential is burned — plan a full domain-wide password rotation including the krbtgt account (twice), not just the accounts you think were touched. Remove the remote-access tooling and persistence, and rebuild any host you cannot prove clean rather than cleaning it in place. Rotate the GlobalProtect certificates and any VPN pre-shared secrets the attacker could have read. Then confirm the config fix held: verify that authentication override either uses a dedicated cert or is disabled, and that no forged session can re-establish. Verify after patching — a rogue Run key and a copied NTDS.dit both survive the firmware upgrade.

Where the wire is the only honest witness

The Qilin chain is the canonical case Zero Hunt's AI Traffic Analysis was built to catch, because every high-cost step in it — credential theft replication, PsExec fan-out, the Rclone egress — is behavioural on the network before it is conclusive on any endpoint, and the attacker's first move after gaining access is to blind the endpoint. Our appliance runs a proprietary deep-learning model trained on billions of PCAP sequences, with four parallel inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting), sustaining 2.7+ Gbit/s on a single on-prem GPU. It does not ask a reputation feed whether MEGA is malicious; it asks whether this host — which has ingested data its entire operational life — has any business opening a sustained TLS tunnel to an ASN it has never spoken to, while its peers stay quiet and the domain controller is being read like a backup target. It answers that question while the exfiltration is running, not in tomorrow's SIEM digest. No cloud callback, no telemetry leaving the building — which matters when the thing you are hunting has already turned off the agents that would normally phone home.

The perimeter side is the other half. The reason CVE-2026-0257 stayed exploitable is that patch state and configuration state are different objects, and a version banner cannot tell you which one you have. Zero Hunt's 10-agent generative pentest validates the reachable condition, not the CMDB entry: a local LLM writes an exploit against your actual GlobalProtect configuration in an ephemeral, gVisor-hardened container, backtested in the AI Gym before it runs, and either it forges a working session or it does not. Change-triggered campaigns re-run that check within the hour when a new appliance appears on the perimeter, and every finding is ECDSA-signed so the answer to "were we exposed on 22 July" is an artefact, not a memory. Patch the firewall, fix the certificate — then prove it, and watch the wire for the day someone gets in anyway.

Running GlobalProtect and want to know whether your override config is exploitable, not just whether it's patched? Get in touch.