Qilin and INC Exploit Palo Alto GlobalProtect Flaw

Ransomware groups Qilin and INC are exploiting an authentication-bypass flaw in Palo Alto Networks’ GlobalProtect VPN to enter corporate networks, according to the company’s Unit 42 threat intelligence team. Investigators say that in one case, attackers moved from a compromised VPN gateway into virtualization infrastructure and extracted domain credentials from a virtual disk. The vulnerability, tracked as CVE-2026-0257, affects the GlobalProtect portal and gateway in PAN-OS. It can allow attackers to establish unauthorized VPN sessions by bypassing authentication controls, including multifactor authentication. Palo Alto Networks disclosed the flaw on May 13, 2026, and later said it had observed limited attempts to exploit unpatched devices. Unit 42 identified Qilin and INC among the ransomware operators exploiting the vulnerability in updates published October 19 and 20. The team said its investigations began in early June and covered organizations across 11 sectors, including education, healthcare, financial services, government, manufacturing, utilities and energy. The reports do not establish how many organizations were affected overall. In the credential-theft case,...