InfoSecBulletin Cybersecurity for mankind
The Qilin ransomware group is exploiting a flaw in PAN-OS GlobalProtect to break into victims’ networks, says the cybersecurity firm Arctic Wolf. Palo Alto Networks fixed the flaw (CVE-2026-0257) on May 13 and warned that hackers started using it to break into company networks. Rapid7 reported seeing this attack on many customers from May 17.
“GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection,” the company warned at the time. “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
Qilin ransomware gang exploiting critical Palo Alto VPN Flaw
“PentestCode” AI Agent Automating Penetration Testing with 18 Tools
CVE-2026-60137, CVE-2026-63030
Patch immediately! 2 high severity WordPress flaws found
Windows LegacyHive 0, AWS, Fortinet, TP-LINK multiple flaws got hackers attention
CVE-2026-53412
Zoom Warns of critical account takeover Flaw via Network Access
India to built Mythos-like AI model “Sarvam AI” and “BharatGen” assigned
Cursor, SonicWall, SharePoint 0-day exploited to the wild
Microsoft Patch Tuesday July-2026 fixes 570 flaws, 3 zero-days
Fortinet Patches 7 Flaws In FortiOS, FortiProxy, FortiPAM, and FortiSandbox
CISA warns Cisco IOS flaw, while VMware flaw allows bypassing authentication
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known security problems on May 29. They told federal agencies to fix their GlobalProtect VPN systems within three days.
Arctic Wolf Labs said on Monday that it saw many cases where hackers used CVE-2026-0257 in attacks that caused Qilin ransomware to encrypt whole domains. They noted that the evidence gathered during their investigation shows several Qilin partners are using this flaw to break into networks.
“Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances,” it said.
“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.”
“Arctic Wolf Labs assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing. This assessment is based on the extensive scanning activity observed and the RaaS model’s tendency to distribute successful exploits among multiple affiliates,” the company added.
Shadowserver now watches over 167,000 GlobalProtect VPNs that are exposed online. Shodan found more than 172,000 IPs with a GlobalProtect fingerprint. But, we don’t know how many are fake or have been fixed for CVE-2026-0257 attacks.
Qilin is a Ransomware-as-a-Service (RaaS) that started in August 2022 under the name “Agenda.” It has taken credit for over 2,000 victims on its dark web leak site.
The list of victims has many big companies like car makers Nissan and Yangfeng, the big Japanese beer company Asahi, pathology service provider Synnovis, publishing company Lee Enterprises, and Australia’s Court Services Victoria.
Palo Alto Networks’ products and services are used by more than 70,000 customers around the world. This includes many big U.S. banks and 90% of the top Fortune 10 companies.
