InfoSecBulletin Cybersecurity for mankind
The Qilin ransomware group is exploiting a flaw in PAN-OS GlobalProtect to break into victims’ networks, says the cybersecurity firm Arctic Wolf. Palo Alto Networks fixed the flaw (CVE-2026-0257) on May 13 and warned that hackers started using it to break into company networks. Rapid7 reported seeing this attack on many customers from May 17.
“GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection,” the company warned at the time. “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known security problems on May 29. They told federal agencies to fix their GlobalProtect VPN systems within three days.
Arctic Wolf Labs said on Monday that it saw many cases where hackers used CVE-2026-0257 in attacks that caused Qilin ransomware to encrypt whole domains. They noted that the evidence gathered during their investigation shows several Qilin partners are using this flaw to break into networks.
“Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances,” it said.
“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.”
“Arctic Wolf Labs assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing. This assessment is based on the extensive scanning activity observed and the RaaS model’s tendency to distribute successful exploits among multiple affiliates,” the company added.
Shadowserver now watches over 167,000 GlobalProtect VPNs that are exposed online. Shodan found more than 172,000 IPs with a GlobalProtect fingerprint. But, we don’t know how many are fake or have been fixed for CVE-2026-0257 attacks.
Qilin is a Ransomware-as-a-Service (RaaS) that started in August 2022 under the name “Agenda.” It has taken credit for over 2,000 victims on its dark web leak site.
The list of victims has many big companies like car makers Nissan and Yangfeng, the big Japanese beer company Asahi, pathology service provider Synnovis, publishing company Lee Enterprises, and Australia’s Court Services Victoria.
Palo Alto Networks’ products and services are used by more than 70,000 customers around the world. This includes many big U.S. banks and 90% of the top Fortune 10 companies.
