InfoSecBulletin Cybersecurity for mankind
The Qilin ransomware group is exploiting a flaw in PAN-OS GlobalProtect to break into victims’ networks, says the cybersecurity firm Arctic Wolf. Palo Alto Networks fixed the flaw (CVE-2026-0257) on May 13 and warned that hackers started using it to break into company networks. Rapid7 reported seeing this attack on many customers from May 17.
“GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection,” the company warned at the time. “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known security problems on May 29. They told federal agencies to fix their GlobalProtect VPN systems within three days.
Arctic Wolf Labs said on Monday that it saw many cases where hackers used CVE-2026-0257 in attacks that caused Qilin ransomware to encrypt whole domains. They noted that the evidence gathered during their investigation shows several Qilin partners are using this flaw to break into networks.
“Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances,” it said.
“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.”
“Arctic Wolf Labs assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing. This assessment is based on the extensive scanning activity observed and the RaaS model’s tendency to distribute successful exploits among multiple affiliates,” the company added.
Shadowserver now watches over 167,000 GlobalProtect VPNs that are exposed online. Shodan found more than 172,000 IPs with a GlobalProtect fingerprint. But, we don’t know how many are fake or have been fixed for CVE-2026-0257 attacks.
Qilin is a Ransomware-as-a-Service (RaaS) that started in August 2022 under the name “Agenda.” It has taken credit for over 2,000 victims on its dark web leak site.
The list of victims has many big companies like car makers Nissan and Yangfeng, the big Japanese beer company Asahi, pathology service provider Synnovis, publishing company Lee Enterprises, and Australia’s Court Services Victoria.
Palo Alto Networks’ products and services are used by more than 70,000 customers around the world. This includes many big U.S. banks and 90% of the top Fortune 10 companies.
