Hackers Exploit Palo Alto PAN-OS Flaw to Deploy Qilin Ransomware

Hackers are exploiting a high-severity vulnerability in Palo Alto Networks’ PAN-OS to gain initial access to corporate networks and deploy Qilin ransomware.

Multiple intrusions investigated in June 2026 began with the exploitation of CVE-2026-0257, an authentication bypass flaw affecting GlobalProtect portal and gateway deployments.

The attacks evolved from external VPN compromises to domain-wide encryption, with some victims also experiencing data theft and double-extortion tactics.

Palo Alto PAN-OS Flaw Deploy Qilin Ransomware

CVE-2026-0257 has a CVSS score of 7.8 and allows unauthenticated attackers to establish GlobalProtect VPN sessions when authentication override cookies and certain certificate configurations are enabled.

Arctic Wolf has linked several incidents of Qilin ransomware to this flaw, noting recurring operational patterns, including ransomware staging in the C:\PerfLogs\ directory, PsExec-based lateral movement, credential dumping, and aggressive event log clearing.

The observed activities indicate that attackers are rapidly exploiting exposed PAN-OS appliances as entry points into Windows domains.

After successful exploitation, threat actors gained access to affected networks through GlobalProtect, harvested credentials from LSASS (Local Security Authority Subsystem Service) and Active Directory, navigated administrative shares, and deployed password-protected Qilin payloads.

While some attacks prioritized quick encryption, others included reconnaissance, remote access tooling, targeting backup systems, and exfiltrating data to MEGA cloud storage.

Qilin, also known as Agenda, is a ransomware-as-a-service operation active since at least 2022. Its affiliates target organizations across various sectors and may employ a double-extortion model, encrypting systems while threatening to publish stolen data.

The variations in tactics observed during the June incidents may reflect different Qilin affiliates leveraging a shared exploit method while employing their own techniques post-compromise.

Affected PAN-OS branches include versions 12.1, 11.2, 11.1, and 10.2 before specific vendor-fixed releases, as well as affected Prisma Access versions. Cloud NGFW and Panorama are not impacted.

Arctic Wolf noted exploitation attempts from numerous external addresses, with some successful VPN sessions originating from devices identified with the hostname “kali.”

Several source IP addresses appeared both during the exploitation attempts and the subsequent VPN connections, suggesting shared attacker infrastructure or a common toolkit.

Once access was gained, operators created persistence through registry Run keys named with regular expressions matching *[a-z]{6} and executed a payload from C:\PerfLogs\win.exe.

They also deployed remote access tools such as AnyDesk, Ngrok, LogMeIn, and, in one instance, MeshAgent to maintain alternate access pathways.

Credential theft involved LSASS memory dumping through comsvcs.dll and rundll32.exe, with the dump output disguised using an .odt extension.

Attackers also employed ntdsutil.exe with the Install From Media method to extract Active Directory data. PsExec and Windows administrative shares, particularly C$, were then used to distribute tools and ransomware throughout the environment.

Before encryption, attackers disabled Microsoft Defender in some cases. They cleared Windows event logs, using PowerShell routines designed to erase every populated log channel. In double-extortion incidents, they utilized tools like Rclone, ProtonDrive, FileZilla, and MEGA to transfer stolen data externally.

Organizations should immediately apply Palo Alto Networks’ fixes for CVE-2026-0257, terminate active GlobalProtect sessions after patching, and review VPN logs for suspicious connections, particularly those coming from hosting providers or systems identifying themselves as “kali.”

Defenders should also monitor and restrict the creation or execution of executables in C:\PerfLogs\, raise alerts on PSEXESVC.exe, abnormal Logon Type 333 activity, LSASS dumping, ntdsutil IFM usage, and remote writes to C:\Windows\Temp or C:\PerfLogs. Centralized event log forwarding is essential, as local logs may be erased before ransomware deployment.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.