# Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw Attackers bypass MFA using CVE-2026-0257 to compromise corporate VPN gateways and virtual environments. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/07390422-f326-42ef-8761-341bc0c7784d ## Critical Authentication Bypass Flaw Palo Alto Networks identified active exploitation of CVE-2026-0257, an authentication bypass vulnerability affecting PAN-OS and Prisma Access. With a CVSS score of 7.8, this flaw allows unauthorized actors to establish VPN connections. The vulnerability was officially patched in May 2026 and subsequently added to the CISA Known Exploited Vulnerabilities catalog on May 13. ## Ransomware Groups Targeting Infrastructure Unit 42 researchers confirmed that ransomware operators, specifically Spikey Scorpius known as Qilin and Tarnished Scorpius known as INC, are actively weaponizing this flaw. These groups utilize the exploit to gain an initial foothold within corporate networks, effectively bypassing multi-factor authentication controls to establish persistent VPN sessions for further malicious activity. ## Broad Sector Impact Observed The attacks linked to these groups have targeted a diverse range of industries globally. Affected sectors include education, financial services, healthcare, high technology, and manufacturing. Additionally, hospitality, professional legal services, government entities, transportation, logistics, utilities, and retail organizations have faced significant threats from these financially motivated actors during the recent campaign. ## Pivot to Virtualization Layers A significant evolution in attacker tactics involves a direct pivot to the virtualization layer after initial compromise. In specific cases, threat actors moved from the VPN gateway to vCenter management appliances. They successfully disabled security controls on ESXi hypervisors and utilized custom tools to perform offline credential dumping directly against domain controller virtual disks. ## Circumventing Endpoint Security Protections This sophisticated approach allows attackers to bypass standard in-guest endpoint detection and response tools. By targeting the virtual disk directly, threat actors obtain domain-wide credentials without triggering traditional security alerts. This technique effectively renders standard host-based protections insufficient, as the malicious activity occurs outside the visibility of the operating system's security agents. ## Chaining Exploits for Maximum Damage Attackers have been observed chaining the initial access method with additional exploit tools to maximize operational impact. Specifically, they target Veeam backup infrastructure by abusing known flaws like CVE-2023-27532. This strategy ensures that organizations suffer maximum damage, often through rapid encryption-only operations or full double-extortion tactics, as previously flagged by Arctic Wolf. ## Proactive Defensive Recommendations Palo Alto Networks strongly advises organizations to apply the latest security fixes immediately to mitigate risk. Beyond patching, security teams should proactively hunt for indicators of compromise within their networks. Initiating appropriate incident response protocols is essential if any successful gateway-connected events are detected, ensuring rapid containment of potential ransomware deployment. ## Strategic Security Posture Evolution The exploitation of CVE-2026-0257 highlights the critical need for robust visibility into virtualized environments and backup infrastructure. As ransomware groups refine their techniques to target hypervisors directly, security operations must evolve to monitor these layers. Organizations should prioritize assessing their threat readiness to defend against such sophisticated, multi-stage attacks effectively. ## Sources covering this story - https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._