InfoSecBulletin Cybersecurity for mankind
The Qilin ransomware group is exploiting a flaw in PAN-OS GlobalProtect to break into victims’ networks, says the cybersecurity firm Arctic Wolf. Palo Alto Networks fixed the flaw (CVE-2026-0257) on May 13 and warned that hackers started using it to break into company networks. Rapid7 reported seeing this attack on many customers from May 17.
“GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection,” the company warned at the time. “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known security problems on May 29. They told federal agencies to fix their GlobalProtect VPN systems within three days.
Arctic Wolf Labs said on Monday that it saw many cases where hackers used CVE-2026-0257 in attacks that caused Qilin ransomware to encrypt whole domains. They noted that the evidence gathered during their investigation shows several Qilin partners are using this flaw to break into networks.
“Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances,” it said.
“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.”
“Arctic Wolf Labs assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing. This assessment is based on the extensive scanning activity observed and the RaaS model’s tendency to distribute successful exploits among multiple affiliates,” the company added.
Shadowserver now watches over 167,000 GlobalProtect VPNs that are exposed online. Shodan found more than 172,000 IPs with a GlobalProtect fingerprint. But, we don’t know how many are fake or have been fixed for CVE-2026-0257 attacks.
Qilin is a Ransomware-as-a-Service (RaaS) that started in August 2022 under the name “Agenda.” It has taken credit for over 2,000 victims on its dark web leak site.
The list of victims has many big companies like car makers Nissan and Yangfeng, the big Japanese beer company Asahi, pathology service provider Synnovis, publishing company Lee Enterprises, and Australia’s Court Services Victoria.
Palo Alto Networks’ products and services are used by more than 70,000 customers around the world. This includes many big U.S. banks and 90% of the top Fortune 10 companies.
