Ransomware Gangs Exploit Palo Alto VPN Flaw to Breach Networks

A critical authentication bypass vulnerability in Palo Alto Networks' GlobalProtect and Prisma Access products is now being actively weaponized by ransomware operators to slip past perimeter defenses and establish unauthorized remote access into corporate networks. Tracked as CVE-2026-0257, the flaw allows attackers to bypass login requirements entirely and open VPN sessions that look, on the surface, indistinguishable from legitimate employee connections. Security firm ReliaQuest has tied the activity to multiple threat groups, including the Qilin and Settra ransomware operations, underscoring how quickly criminal actors move once a usable exploit for enterprise remote-access software becomes available.

What makes this campaign particularly difficult to catch is the trust organizations place in their own VPN infrastructure. Rather than tripping alarms associated with suspicious external traffic, attackers enter through a channel that security teams are conditioned to treat as safe. That dynamic often delays detection until later stages of an intrusion, such as credential theft or lateral movement, are already underway. For organizations building layered defenses, this incident is a reminder that perimeter trust has to be paired with other controls, including network segmentation and tools like malware filtering at the DNS level, which can catch malicious command-and-control traffic even after an attacker has gained initial footing. malware filtering at the DNS level

How the Vulnerability Works

Palo Alto Networks describes CVE-2026-0257 as an authentication bypass affecting both the GlobalProtect portal and gateway components. Successful exploitation lets an attacker skip the normal authentication sequence and establish a VPN connection as though they were a verified user. Crucially, exposure is not universal. The vulnerability depends on specific configuration conditions: authentication override cookies must be enabled, paired with a particular certificate setup. Panorama and Cloud NGFW deployments are not affected. This means simply running GlobalProtect does not automatically place an organization at risk; administrators need to check their actual portal and gateway settings against the vendor's advisory rather than assume uniform exposure across all deployments.

Signs of Compromise and Follow-On Activity

ReliaQuest has observed post-exploitation tooling consistent with established ransomware tactics, including Cobalt Strike, BloodHound, and SharpHound, used for reconnaissance and lateral movement once attackers gain a foothold. Not every intrusion follows the same sequence or deploys all three tools, but their presence alongside unexplained VPN activity is a meaningful warning sign. Investigators are advised to scrutinize unexpected GlobalProtect sessions, including connections associated with hostnames such as "kali." ReliaQuest flags this particular hostname as worth investigating, though it should be weighed against broader connection history and corroborating evidence rather than treated as conclusive proof of attacker identity on its own.

What Organizations Should Do Now

Patching alone will not undo damage from sessions attackers already established before remediation. ReliaQuest recommends a two-track response: upgrade affected deployments immediately and disable authentication override cookies where they are not strictly necessary, while separately terminating all active GlobalProtect sessions after the patch is applied and reviewing logs for anomalous connections. Addressing the underlying vulnerability and removing any access already gained are distinct tasks, and incident response plans need to cover both.

• Patch GlobalProtect portal and gateway software without delay
• Disable authentication override cookies unless operationally required
• Terminate all active VPN sessions following remediation
• Audit logs for unfamiliar hostnames and irregular session patterns
• Monitor for Cobalt Strike, BloodHound, and SharpHound indicators

ReliaQuest assesses that exploitation will likely remain prevalent over the coming months, as ransomware groups and initial access brokers continue probing for unpatched systems. The firm has also published indicators of compromise, including several IPv4 addresses tied to the observed activity, to support ongoing investigations. Given how central VPN infrastructure has become to remote work, this episode illustrates a broader pattern: the tools built to secure distributed workforces are themselves high-value targets, and their defense now requires the same rigor once reserved for the networks they were designed to protect.