Ransomware Gangs Exploit GlobalProtect VPN Flaw — What to Check

Ransomware operators continue targeting a GlobalProtect VPN flaw patched in May 2026, with documented intrusions extending into corporate virtualization infrastructure.

In an October 19, 2026, update, Palo Alto Networks' Unit 42 identified continued exploitation attempts involving Qilin and Inc ransomware operators targeting CVE-2026-0257. Investigators documented attackers reaching VMware infrastructure, where they extracted domain credentials while bypassing security tools operating inside virtual machines.

Security teams running vulnerable GlobalProtect configurations must verify patching and investigate whether attackers established access before remediation.

GlobalProtect attacks reach virtualization and backup systems

The Unit 42 investigation identifies Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius), while acknowledging separate public reports involving Settra ransomware.

CVE-2026-0257 affects certain PAN-OS and Prisma Access deployments using authentication-override cookies with a vulnerable certificate configuration. Attackers can establish unauthorized VPN sessions without completing normal authentication, including multifactor authentication (MFA).

Palo Alto Networks rates the flaw High severity (7.8 under CVSS 4.0). Disclosed May 13, 2026, it was added to CISA's Known Exploited Vulnerabilities catalog May 29.

Investigators observed reconnaissance using legitimate remote management software, followed by lateral movement through RDP and SMB. Similar abuse of trusted remote management tools creates detection challenges for security teams.

In one intrusion, attackers reached VMware vCenter, disabled the execInstalledOnly security control on ESXi hosts, and extracted domain credentials from a virtual disk, bypassing in-guest security controls. Unit 42 also observed attackers combining VPN access with exploit tools targeting Veeam backup infrastructure, including CVE-2023-27532.

Separately, Arctic Wolf documented June intrusions culminating in Qilin ransomware deployment. Cisco firewall management vulnerabilities have likewise enabled ransomware attacks against internal networks.

Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, recommended limiting access available to compromised security appliances.

"Treat the firewall as an adversary-accessible endpoint, and segment so a compromised gateway cannot reach everything behind it," Krell said.

Patching, threat hunting and recovery safeguards

Administrators should address vulnerable configurations and investigate earlier access. Recent Ivanti VPN credential-theft attacks illustrate why remediation must extend beyond software updates.

• Patch and harden authentication. Apply fixed PAN-OS and Prisma Access releases listed in the vendor advisory. Disable unnecessary authentication-override cookies or use dedicated certificates. Update relevant portals and gateways, then ensure strict HMAC validation is enabled.
• Review VPN activity. Investigate suspicious gateway-connected events, source IP addresses, and identifiers such as GP-CLIENT and DESKTOP-GP01. Correlate indicators before confirming compromise.
• Investigate internal access. Examine privileged accounts, RDP and SMB activity, vCenter and ESXi configurations, and Veeam systems for unauthorized changes or credential theft.
• Limit lateral movement. Segment VPN access from domain controllers, hypervisor management interfaces, and backup servers. Enforce least privilege and separate administrative accounts.
• Restrict management exposure. Check externally accessible management interfaces on ports 4443 and 3879, a separate configuration concern identified in Unit 42's October 20 update.
• Test incident response plans. Revoke compromised access, rotate exposed credentials, investigate persistence, and verify backup restoration using protected recovery copies.

Darin Fredde, senior director of technical marketing engineering at Ridge Security, stressed the importance of validating remediation.

"Discovering vulnerabilities faster means little if we cannot fix them just as effectively," Fredde said.

Patching closes the known vulnerability, but reviewing earlier VPN activity and downstream systems remains necessary to identify possible compromise and limit ransomware damage.

Read more: The FBI's SafePay ransomware warning covering more than 600 affected organizations details how compromised credentials, exposed services, and attacks on recovery infrastructure can disrupt enterprise operations.