InfoSecBulletin Cybersecurity for mankind
The Qilin ransomware group is exploiting a flaw in PAN-OS GlobalProtect to break into victims’ networks, says the cybersecurity firm Arctic Wolf. Palo Alto Networks fixed the flaw (CVE-2026-0257) on May 13 and warned that hackers started using it to break into company networks. Rapid7 reported seeing this attack on many customers from May 17.
“GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection,” the company warned at the time. “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548Â
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known security problems on May 29. They told federal agencies to fix their GlobalProtect VPN systems within three days.
Arctic Wolf Labs said on Monday that it saw many cases where hackers used CVE-2026-0257 in attacks that caused Qilin ransomware to encrypt whole domains. They noted that the evidence gathered during their investigation shows several Qilin partners are using this flaw to break into networks.
“Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances,” it said.
“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.”
“Arctic Wolf Labs assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing. This assessment is based on the extensive scanning activity observed and the RaaS model’s tendency to distribute successful exploits among multiple affiliates,” the company added.
Shadowserver now watches over 167,000 GlobalProtect VPNs that are exposed online. Shodan found more than 172,000 IPs with a GlobalProtect fingerprint. But, we don’t know how many are fake or have been fixed for CVE-2026-0257 attacks.
Qilin is a Ransomware-as-a-Service (RaaS) that started in August 2022 under the name “Agenda.” It has taken credit for over 2,000 victims on its dark web leak site.
The list of victims has many big companies like car makers Nissan and Yangfeng, the big Japanese beer company Asahi, pathology service provider Synnovis, publishing company Lee Enterprises, and Australia’s Court Services Victoria.
Palo Alto Networks’ products and services are used by more than 70,000 customers around the world. This includes many big U.S. banks and 90% of the top Fortune 10 companies.
