# Palo Alto Networks PAN-OS Vulnerability Exploited by Ransomware Groups Multiple threat actors are leveraging a critical authentication bypass bug to breach corporate networks. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/f0904d26-f7e0-414b-9160-65f6b891f95e ## Authentication Bypass Vulnerability The high-severity vulnerability, identified as CVE-2026-0257, affects Palo Alto Networks' PAN-OS GlobalProtect portals and gateways. Originally disclosed on May 13, the flaw allows attackers to bypass security restrictions and establish unauthorized VPN connections. While initially rated as medium-severity, subsequent evidence confirmed active exploitation across numerous customer environments starting from mid-May. ## Active Ransomware Campaigns Unit 42 reports that multiple ransomware groups, specifically Qilin and Inc, are actively targeting the vulnerability. These actors utilize the exploit to gain an initial foothold within corporate networks. By bypassing multi-factor authentication, they establish persistent VPN sessions, facilitating further malicious activities across a wide range of diverse industry sectors. ## Lateral Movement Tactics Once inside the network, attackers move laterally using Remote Desktop Protocol and Server Message Block protocols. They deploy additional malware designed for credential harvesting and data theft before initiating the final ransomware payload. This systematic approach allows criminals to escalate privileges and compromise sensitive data across various organizational infrastructure components. ## Targeted Industry Sectors The scope of these attacks is extensive, impacting numerous industries including education, financial services, healthcare, and high tech. Other affected sectors span hospitality, manufacturing, professional services, government, transportation, and energy. The widespread nature of these infections highlights the critical risk posed to organizations relying on vulnerable PAN-OS software for remote access. ## Advanced Virtualization Attacks A significant evolution in attacker tactics involves pivoting directly to the virtualization layer. In specific cases, adversaries moved from compromised VPN gateways to vCenter management appliances. By disabling security controls on ESXi hypervisors, they utilized custom tools to perform offline credential dumping directly against virtual disks, effectively bypassing standard endpoint detection. ## Exploit Chaining Techniques Threat actors are increasingly chaining the CVE-2026-0257 exploit with other known vulnerabilities to maximize their impact. Unit 42 observed criminals combining this initial access method with CVE-2023-27532, which targets Veeam backup infrastructure. This multi-stage approach demonstrates a high level of sophistication in how attackers navigate and compromise complex enterprise backup environments. ## Incident Response Requirements Palo Alto Networks advises all organizations to verify their patch status immediately. Beyond applying the necessary updates, security teams must investigate their networks for signs of prior unauthorized access. Utilizing the indicators of compromise provided by Unit 42 is essential for effective threat-hunting activities to detect potential hidden persistence within the infrastructure. ## Strategic Security Implications The exploitation of this vulnerability underscores the necessity of robust perimeter security and proactive patch management. As threat groups refine their techniques to target virtualization layers, organizations must adopt a defense-in-depth strategy. Monitoring for lateral movement and securing management appliances are now critical components of maintaining a resilient security posture against ransomware. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._