# Qilin Ransomware Gang Exploits PAN-OS Vulnerability

Critical VPN flaw puts corporate networks at risk.

- **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb)
- **Published:** 2026-07-21
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://securityaffairs.com/195730/cyber-crime/qilin-ransomware-affiliates-abuse-cve-2026-0257-to-gain-unauthorized-vpn-access.html>
- **On Brifing:** https://brifing.si/s/dbf73c3c-d614-44d6-9cb9-7318e4d9423d

## Critical Vulnerability and Impact

The Qilin ransomware gang exploits the CVE-2026-0257 flaw in PAN-OS GlobalProtect systems to gain unauthorized VPN access to corporate networks. This vulnerability bypasses authentication, allowing cyber attackers to infiltrate networks. Palo Alto Networks released a patch in May, but unpatched systems remain at risk.

## Widespread Attacks

Arctic Wolf researchers identified multiple companies compromised by Qilin ransomware in June 2026 due to this vulnerability. Attacks ranged from rapid encryption operations to double extortion tactics, indicating Qilin's ransomware-as-a-service model with varied affiliate tactics.

## Post-Exploitation Process

Attackers exploit the flaw to initiate VPN sessions from Kali Linux systems. They then establish persistent access using registry keys and remote administration tools. Techniques like LSASS memory dumping and Active Directory database theft enable lateral movement within networks.

## Data Theft and Encryption

In some attacks, the Qilin gang conducts large-scale data exfiltration using cloud storage tools like Rclone, ProtonDrive, and MEGA. Other attacks focus solely on rapid encryption. The ransomware payload is typically stored as 'win.exe' in the C:\PerfLogs directory.

## Sector-Specific Targets

The Qilin ransomware gang targets critical sectors like healthcare, manufacturing, and finance. Active since 2022, the group has claimed over 40 victims monthly. A strategic alliance with DragonForce and LockBit in October 2025 further complicated the cyber threat landscape.

## Protective Measures

Experts recommend updating PAN-OS systems with the latest patches. Network monitoring and detecting abnormal VPN sessions are crucial for prevention. Multi-factor authentication and strict access controls can mitigate ransomware impact. Proactive cybersecurity measures are essential for defense.

## Sources covering this story

- https://securityaffairs.com/195730/cyber-crime/qilin-ransomware-affiliates-abuse-cve-2026-0257-to-gain-unauthorized-vpn-access.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._