Ransomware Crews Chain PAN-OS CVE-2026-0257 to vCenter, ESXi and Veeam: Qilin and Inc Attempts Flagged

What changed

Palo Alto Networks Unit 42 updated its threat brief on CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway components of PAN-OS, on 19 and 20 October 2026. The 19 October update added ransomware activity. The 20 October update added verification and remediation guidance. The flaw has been publicly known and exploited since late spring, so what is new is who is using it and what they do next.

Unit 42 describes the threat actors this way:

• Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are described as ransomware operators attempting exploitation. “Attempting” is Unit 42’s framing and we keep it. The brief does not claim a confirmed encryption event tied to this flaw for either group.
• Unit 42 also cites public reporting that attributes exploitation to actors using Settra ransomware. It cites this reporting and does not confirm it. We list it as unconfirmed.
• Unit 42’s original brief called the actor “an unidentified threat actor.” That earlier framing has been superseded for the ransomware activity above.

Observed post-access behaviour

Unit 42 describes the following sequence after the initial bypass:

1. Attackers gain initial access, then bypass MFA to establish a VPN session.
2. They run reconnaissance using remote monitoring and management (RMM) tooling.
3. They move laterally over RDP and SMB.
4. They use tooling for credential harvesting, exfiltration and ransomware deployment.
5. In one case, attackers pivoted from the VPN gateway to the vCenter appliance, disabled ESXi security controls, and dumped credentials offline from a domain controller’s VMDK.
6. Actors have also chained this access with exploitation of Veeam CVE-2023-27532.

The vCenter step matters most. Reaching the hypervisor management plane lets an operator touch every virtual machine at once, including the domain controller’s virtual disk, without ever logging in to the guest. Dumping credentials from a copied VMDK avoids most endpoint monitoring because the domain controller’s own agent never sees it. The Veeam step fits a familiar ransomware pattern of attacking backups before encryption. That reading of intent is ours.

Scope and caveats

• Unit 42 states that only a small portion of the probed devices actually established VPN sessions. Exposure to scanning is not the same as compromise.
• A line in the brief that “no post-access behavior or lateral movement has been identified as of this time” belongs to the earliest version of the page and predates the October updates, which do describe post-access activity.
• We do not have victim names, sectors or counts from Unit 42 for this activity. We have not independently tied a specific leak-site victim to this flaw, so none are listed.
• This tracker has not verified the CVSS score or the version-by-version fix list. Use the Palo Alto Networks advisory for both.

Defensive actions

1. Apply the vendor fix or workaround. Review the Palo Alto Networks security advisory and either apply the listed mitigations or upgrade to a fixed version.
2. Check management interface exposure. Unit 42 warns that GlobalProtect profiles mapped to HTTP/HTTPS on management interfaces can expose ports 4443 and 3879 to the internet. Test by attempting an external HTTPS connection to the management IP on those ports, and restrict access with Interface Management profiles.
3. Hunt for the indicators. Unit 42 lists nine IP addresses tied to successful GlobalProtect logins before the proof of concept, including 23.128.228[.]6, 104.207.144[.]154 and 179.43.172[.]213, and host IDs such as aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. After the 29 May proof of concept, it also lists configuration values such as endpoint_os_version: Microsoft Windows 10 Pro 64-bit with an empty source_user_info.domain. Use the full list from the brief.
4. Start incident response on a match. Unit 42 recommends activating incident response for any successful gateway-connected events matching these indicators.
5. Treat a VPN compromise as a hypervisor risk. Confirm that vCenter and ESXi management sit on a segment unreachable from VPN pools. Require separate administrative credentials and MFA for vCenter, and review whether ESXi security settings such as lockdown mode have been changed.
6. Protect backups. Patch Veeam against CVE-2023-27532, keep backup servers off the domain where possible, and hold at least one immutable or offline copy.
7. Restrict VMDK access. Limit who can copy or export domain controller disks and alert on datastore browsing and snapshot or clone activity involving them.

Why this matters for the ransomware picture

Qilin has been the most active leak-site group this month on the counts we have seen: HackerFeeds showed 77 Qilin victims in October against 74 in September as of 19 October, a partial month. That is a third-party count and not a figure we verified. Inc has also continued to operate. Edge VPN flaws remain a favoured entry point because a working bypass turns a “patched” vulnerability into a long-lived opening for organisations that have not applied the fix. We think the signal worth noting is the dwell between disclosure and ransomware adoption: this flaw was known months before Unit 42 added these actors. That interval is an inference from the dates in the brief.

Sources

• Palo Alto Networks Unit 42, “Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257” (updated 20 October 2026): https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
• HackerFeeds, “Ransomware Attacks in October 2026” (partial month, as of 19 October): https://hackerfeeds.com/ransomware/reports/2026-10