InfoSecBulletin Cybersecurity for mankind
Ransomware groups are using a flaw in Palo Alto Networks GlobalProtect VPN to get around multi-factor authentication and access corporate networks. In one case studied, attackers got into VMware management systems and took credentials from a domain controller’s virtual disk, evading the security tools in the virtual machine.
Palo Alto Networks Unit 42 shared details in a threat update on October 19. Researchers found that CVE-2026-0257 was linked to Spikey Scorpius, also called Qilin, and Tarnished Scorpius, also called Inc. Other reports connected this to people using Settra ransomware.
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session. Following this, the threat actors are typically:
Conducting internal network reconnaissance using dual-use remote monitoring and management (RMM) tools
Moving laterally via RDP and SMB
Staging additional tooling for credential harvesting, data exfiltration and ultimately, ransomware deployment
Investigations that started in early June have looked into healthcare, education, finance, manufacturing, government, energy, and more. The newest findings reveal that unauthorized VPN access can lead to stealing credentials, data theft, and using ransomware.
Defenders should examine GlobalProtect logs for successful gateway-connected events linked to suspicious sources and client details. Reported indicators include 104.207.144[.]154, 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host IDs aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. Earlier monitoring found that many probes did not establish full VPN sessions, making connection events important for investigation.
Organizations should follow the advice from Palo Alto Networks and upgrade any affected portal and gateway. For now, they can disable authentication override or create a new certificate just for override cookies.
Related news:
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
