InfoSecBulletin Cybersecurity for mankind
Ransomware groups are using a flaw in Palo Alto Networks GlobalProtect VPN to get around multi-factor authentication and access corporate networks. In one case studied, attackers got into VMware management systems and took credentials from a domain controller’s virtual disk, evading the security tools in the virtual machine.
Palo Alto Networks Unit 42 shared details in a threat update on October 19. Researchers found that CVE-2026-0257 was linked to Spikey Scorpius, also called Qilin, and Tarnished Scorpius, also called Inc. Other reports connected this to people using Settra ransomware.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session. Following this, the threat actors are typically:
Conducting internal network reconnaissance using dual-use remote monitoring and management (RMM) tools
Moving laterally via RDP and SMB
Staging additional tooling for credential harvesting, data exfiltration and ultimately, ransomware deployment
Investigations that started in early June have looked into healthcare, education, finance, manufacturing, government, energy, and more. The newest findings reveal that unauthorized VPN access can lead to stealing credentials, data theft, and using ransomware.
Defenders should examine GlobalProtect logs for successful gateway-connected events linked to suspicious sources and client details. Reported indicators include 104.207.144[.]154, 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host IDs aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. Earlier monitoring found that many probes did not establish full VPN sessions, making connection events important for investigation.
Organizations should follow the advice from Palo Alto Networks and upgrade any affected portal and gateway. For now, they can disable authentication override or create a new certificate just for override cookies.
Related news:
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
