Hackers Exploit Palo Alto Networks PAN-OS Flaw to Bypass MFA and Deploy Ransomware

Ransomware operators are exploiting a vulnerability in Palo Alto Networks PAN-OS that allows them to bypass authentication. This issue enables unauthorized VPN sessions, bypasses multifactor authentication (MFA), and allows access to corporate networks.

According to Unit 42’s October 19 update, two groups, Spikey Scorpius (also referred to as Qilin) and Tarnished Scorpius, are using CVE-2026-0257. Public reports also link these attacks to actors using Settra ransomware.

Investigations that began in early June 2026 have affected sectors including healthcare, education, financial services, government, manufacturing, and energy. The findings document a range of ransomware activities beyond the initially reported successful VPN connections.

Palo Alto Networks PAN-OS Flaw

The vulnerability affects the GlobalProtect portal and gateway components in vulnerable PAN-OS installations. For the exposure to occur, authentication override cookies must be enabled alongside a specific certificate configuration.

Palo Alto Networks classifies this weakness as inadequate validation and integrity checking of cookies, assigning it a CVSS score of 7.8. Notably, the Panorama and Cloud NGFW are not affected.

Successful exploitation lets attackers bypass security restrictions and establish VPN connectivity without using standard authentication protocols.

After gaining access, operators perform internal reconnaissance using dual-use remote monitoring and management tools, move laterally through RDP and SMB, and deploy utilities for credential harvesting, data exfiltration, and ransomware deployment.

A significant development is that attackers now directly access virtualization management infrastructure after obtaining VPN access. In one investigation, intruders accessed a vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors, and employed custom tools to extract credentials offline from a domain controller’s virtual disk (VMDK).

Since this credential access targets virtual storage rather than processes running within the guest operating system, it effectively bypasses in-guest endpoint detection and response controls.

Unit 42 has also noted that attackers are combining their initial compromise with tools targeting Veeam backup infrastructure through CVE-2023-27532.

Defenders should review GlobalProtect logs for successful gateway connection events linked to suspicious device identifiers, such as aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01, and GP-CLIENT.

Signs of post-proof-of-concept activity might include the endpoint OS version listed as “Microsoft Windows 10 Pro 64-bit” and an empty source_user_info.domain field.

Historical source addresses to investigate include 23.128.228[.]6, 104.207.144[.]154, and 179.43.172[.]213. However, Unit 42 recommends searching for suspicious client identifiers across connections from any address, rather than only focusing on known infrastructure. Successful connections that match these indicators should trigger an incident response.

Administrators are advised to upgrade all affected portals and gateways to the latest fixed releases. Alternatively, they can disable authentication override or generate a new certificate specifically for authentication override cookies.

Fixed releases will securely regenerate cookies, so users must authenticate again after upgrading. Organizations using hybrid Prisma Access deployments must also upgrade their affected on-premises firewalls to ensure cookie compatibility across their environments.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.