Qilin Ransomware Gang Exploits PAN-OS Vulnerability
Critical VPN flaw puts corporate networks at risk.
1Critical Vulnerability and Impact
The Qilin ransomware gang exploits the CVE-2026-0257 flaw in PAN-OS GlobalProtect systems to gain unauthorized VPN access to corporate networks. This vulnerability bypasses authentication, allowing cyber attackers to infiltrate networks. Palo Alto Networks released a patch in May, but unpatched systems remain at risk.
2Widespread Attacks
Arctic Wolf researchers identified multiple companies compromised by Qilin ransomware in June 2026 due to this vulnerability. Attacks ranged from rapid encryption operations to double extortion tactics, indicating Qilin's ransomware-as-a-service model with varied affiliate tactics.
3Post-Exploitation Process
Attackers exploit the flaw to initiate VPN sessions from Kali Linux systems. They then establish persistent access using registry keys and remote administration tools. Techniques like LSASS memory dumping and Active Directory database theft enable lateral movement within networks.
4Data Theft and Encryption
In some attacks, the Qilin gang conducts large-scale data exfiltration using cloud storage tools like Rclone, ProtonDrive, and MEGA. Other attacks focus solely on rapid encryption. The ransomware payload is typically stored as 'win.exe' in the C:\PerfLogs directory.
5Sector-Specific Targets
The Qilin ransomware gang targets critical sectors like healthcare, manufacturing, and finance. Active since 2022, the group has claimed over 40 victims monthly. A strategic alliance with DragonForce and LockBit in October 2025 further complicated the cyber threat landscape.
6Protective Measures
Experts recommend updating PAN-OS systems with the latest patches. Network monitoring and detecting abnormal VPN sessions are crucial for prevention. Multi-factor authentication and strict access controls can mitigate ransomware impact. Proactive cybersecurity measures are essential for defense.
Original article: Security Affairs — Qilin Ransomware Çetesinin PAN-OS Açığını Kullanması