The activity targets CVE-2026-0257, an authentication bypass flaw affecting certain configurations of GlobalProtect, the virtual private network service used by organisations to give employees access to internal systems. Palo Alto Networks issued fixes on 13 May, but attacks against unprotected installations have continued.
ReliaQuest identified both ransomware operations among groups using the weakness to establish unauthorised VPN sessions. It also observed offensive security tools including Cobalt Strike, BloodHound and SharpHound, which can help intruders maintain access, examine network relationships and identify routes towards more sensitive systems.
The company assessed that exploitation attempts were highly likely to continue over the next three months. Its warning raises particular concern because intruders entering through a company’s own VPN infrastructure can appear similar to legitimate remote workers, complicating detection before further malicious activity takes place.
ReliaQuest said compromised access could precede credential theft, movement between computers, data theft or ransomware deployment. The assessment does not establish that every attempt succeeded or that each observed intrusion resulted in files being encrypted. The company has not disclosed an aggregate number of affected organisations or a confirmed financial loss from the latest activity.
Palo Alto Networks classifies the flaw as high severity, assigning it a score of 7.8 under the Common Vulnerability Scoring System and its highest remediation urgency. Its security advisory confirms that successful exploitation can allow an attacker to bypass authentication checks and establish a VPN connection without legitimate credentials.
Exposure depends on specific settings. Vulnerable firewalls must have a GlobalProtect portal or gateway configured with authentication override cookies enabled and a particular certificate configuration. The problem affects designated versions of PAN-OS 10.2, 11.1, 11.2 and 12.1, as well as specified Prisma Access releases. Palo Alto says its Panorama management platform and Cloud NGFW service are not affected.
The company has published fixed software versions and recommends that customers upgrade affected systems. Where immediate updates are impossible, administrators can disable authentication override functionality or use a dedicated certificate exclusively for override cookies rather than sharing one with other services.
ReliaQuest urged organisations to terminate active GlobalProtect sessions after patching and examine unusual connections, including those presenting a hostname such as “kali”. It cautioned that installing a patch does not necessarily eliminate access established by attackers before the update, making retrospective investigation an important part of remediation.
Evidence of ransomware exploitation predates the latest alert. Arctic Wolf Labs documented multiple intrusions during June in which attackers used CVE-2026-0257 as an initial entry point before deploying Qilin ransomware across victim environments. Investigators observed cases involving both rapid encryption and attempts to steal information alongside encryption.
The Arctic Wolf investigations also identified credential harvesting, movement across Windows networks using administrative shares and efforts to clear system logs. Some attackers staged ransomware files in the Windows PerfLogs directory and used PsExec to execute malicious software on additional machines. Its researchers said varying methods could reflect different affiliates operating under the Qilin ransomware service model.
Earlier monitoring by Palo Alto Networks’ Unit 42 team identified attempted exploitation against GlobalProtect portals and gateways. At that stage, researchers said only a small proportion of probed devices had established VPN connections and they had not identified subsequent lateral movement in the activity they examined.
The United States Cybersecurity and Infrastructure Security Agency added CVE-2026-0257 to its Known Exploited Vulnerabilities catalogue on 29 May, recognising evidence that the flaw was being exploited. The listing required covered federal agencies to address the issue within the agency’s stipulated deadline, reinforcing the urgency of patching internet-facing devices.
Palo Alto Networks says upgrading systems that use authentication override cookies triggers a one-time requirement for GlobalProtect users to authenticate again. The company also advises customers with interconnected portals and gateways to bring all relevant components onto compatible fixed versions, rather than leaving mixed deployments in place.
For organisations reviewing logs, Arctic Wolf identified suspicious VPN sessions associated with devices presenting the hostname “kali” and external addresses that appeared both during exploitation attempts and subsequent connections. Such indicators warrant examination alongside authentication records and endpoint activity, rather than being treated alone as proof of compromise. Investigators also recommend checking whether those connections preceded unusual credential use or administrative activity.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
