PAN-OS GlobalProtect Vulnerability Used as Entry Point for Qilin Ransomware Attacks

Overview

Arctic Wolf Labs published an analysis of incidents where attackers used CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect as the initial access point into corporate networks. In some investigated cases, the access led to Qilin ransomware deployment.

The vulnerability affects the GlobalProtect portal and gateway components. Under specific configurations, it enables authentication bypass, allowing an attacker to establish an unauthorized VPN session that may appear like legitimate remote access.

The topic matters because GlobalProtect often sits between the internet and the internal network. If this component is used for entry, attackers may bypass parts of the perimeter control layer and operate directly inside the environment.

What Happened

CVE-2026-0257 affects PAN-OS GlobalProtect portal and gateway. According to Palo Alto Networks, the vulnerability allows an attacker to bypass security restrictions and establish an unauthorized VPN connection in affected configurations.

Arctic Wolf describes several June 2026 incidents where the vulnerability was used for initial access. After establishing a VPN session, attackers gained interactive access to the internal network and began fast post-exploitation activity.

Observed tools and techniques included:

• AnyDesk, Ngrok and LogMeIn for redundant remote access;

• LSASS credential dumping using rundll32.exe and comsvcs.dll;

• Active Directory database extraction using ntdsutil.exe;

• PsExec and administrative shares for lateral movement;

• Rclone for data exfiltration to MEGA cloud storage;

• disabling Microsoft Defender real-time protection;

• clearing Windows Event Logs;

• ransomware payload staged in C:\PerfLogs.

This reflects a typical ransomware playbook: initial access, persistence, credential collection, lateral movement, data exfiltration and encryption.

Why This Matters

GlobalProtect and other VPN/remote access solutions are critical to the organization because they manage access for employees, administrators, providers and external teams. They are often tied to identity infrastructure, Active Directory, MFA (Multi-Factor Authentication), policy controls and internal resources.

When such a component is compromised, the risk does not remain at firewall level. It may affect:

• internal network visibility;

• Active Directory;

• service accounts;

• administrative credentials;

• file servers;

• cloud storage;

• backup environments;

• endpoint protection;

• ransomware resilience.

An authentication bypass in remote access infrastructure should therefore be treated as high priority, even when the formal severity score is not the highest in the list.

How the Attack Develops

Arctic Wolf describes fast and structured post-exploitation activity after initial access.

A typical scenario includes:

• establishing an unauthorized GlobalProtect VPN session;

• deploying remote access tools;

• creating persistence through registry Run keys;

• extracting credentials from LSASS;

• extracting the Active Directory database;

• moving laterally through PsExec and administrative shares;

• exfiltrating data via Rclone;

• disabling defensive controls;

• clearing local logs;

• deploying Qilin ransomware.

In some cases, attackers moved to encryption with short dwell time. In others, they conducted deeper reconnaissance, credential harvesting and exfiltration before encryption. This pattern is consistent with ransomware-as-a-service operations, where different affiliates use similar access but vary in tempo and post-exploitation choices.

Why Credential Access Is Critical

In the observed incidents, attackers did not rely only on the ransomware payload. Before encryption, they searched for credentials and Active Directory access.

This matters because if LSASS data or the Active Directory database is extracted, risk can remain after initial containment. Compromised passwords, hashes, service accounts or domain credentials may be reused.

When CVE-2026-0257 exploitation is suspected, response should include more than patching. Teams should check for:

• successful unauthorized VPN sessions;

• credential dumping;

• domain controller access;

• use of ntdsutil.exe;

• lateral movement;

• exfiltration to cloud storage;

• endpoint protection disabling;

• cleared or missing Windows Event Logs.

Recommended Actions

Organizations using PAN-OS GlobalProtect or Prisma Access should treat this vulnerability as a priority.

Initial actions:

• identify all PAN-OS and Prisma Access environments using GlobalProtect;

• check whether they are affected by CVE-2026-0257;

• apply the relevant fixes according to Palo Alto Networks guidance;

• terminate active GlobalProtect sessions after updating;

• review unusual VPN sessions and logins;

• inspect logs for sources that do not match normal access patterns;

• check for hostnames that are atypical for the corporate environment;

• analyze activity from VPN sessions toward domain controllers;

• look for rundll32.exe + comsvcs.dll LSASS dump patterns;

• review use of ntdsutil.exe;

• monitor PsExec, C$ access and lateral movement;

• restrict execution from C:\PerfLogs;

• forward Windows Event Logs to a central SIEM to preserve evidence if local logs are cleared.

If exploitation is suspected:

• rotate affected domain credentials;

• assess whether a KRBTGT reset is required;

• review service accounts;

• analyze cloud exfiltration traces;

• check backup access;

• hunt for Qilin ransomware indicators;

• document the timeline and response actions.

DIAMATIX Perspective

This attack shows why remote access infrastructure must be managed as a critical part of identity and ransomware defence.

With CVE-2026-0257, the risk is not only the unauthorized VPN session. The risk is what happens after it: credential dumping, Active Directory access, lateral movement, exfiltration and ransomware deployment.

DIAMATIX treats cases like this as a visibility and response readiness issue. Firewall/VPN logs, endpoint telemetry, Active Directory events, cloud activity and ransomware indicators need to be analyzed together, not separately.

CISO Analysis

For CISOs, the key question is whether GlobalProtect environments are visible, updated and included in ransomware response processes.

Key questions to review:

• Do we use affected PAN-OS or Prisma Access versions?

• Have the fixes for CVE-2026-0257 been applied?

• Were active VPN sessions terminated after patching?

• Were there unusual GlobalProtect sessions before updating?

• Were domain controllers checked for suspicious access from VPN?

• Are there traces of LSASS dumping, ntdsutil.exe, PsExec or Rclone?

• Are Windows Event Logs forwarded to a central SIEM?

• Is there a playbook for ransomware that begins with remote access compromise?

The practical takeaway: for an actively exploited VPN vulnerability, patching is only the first step. Teams must verify whether access was already used and whether identity infrastructure was affected.

What This Means for Your Environment

• This type of risk relies on affected remote access infrastructure that can allow unauthorized VPN sessions.

• Detection depends on visibility into GlobalProtect logs, VPN sessions, endpoint activity, Active Directory events, credential dumping patterns and data exfiltration.

• Response requires patching, session termination, compromise review, credential rotation, ransomware activity hunting and centralized log retention.

Key questions to review:

• Do you know which GlobalProtect environments are reachable from the internet?

• Do you have a priority patching process for actively exploited VPN vulnerabilities?

• Can your SOC connect VPN sessions with follow-on Active Directory activity?

• Do you check for cleared Windows Event Logs?

• Do you have a plan if ransomware access begins through remote access infrastructure?

Review remote access risk before it becomes a ransomware incident

DIAMATIX can help review:

• PAN-OS GlobalProtect exposure and patch status;

• VPN sessions and suspicious logins;

• Active Directory and credential dumping indicators;

• endpoint and ransomware telemetry;

• centralized log collection;

• SOC/MDR readiness for ransomware attacks through remote access.

Request a remote access and ransomware risk review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Arctic Wolf Labs. CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass.

• Palo Alto Networks Security Advisory. CVE-2026-0257.

• Palo Alto Networks Unit 42. Active Exploitation of PAN-OS CVE-2026-0257.

• NVD. CVE-2026-0257.

• Cyber Security News. Hackers Exploiting Palo Alto’s PAN-OS Vulnerability to Deploy Qilin Ransomware.

This article is based on publicly available information as of July 2026.