Qilin and INC ransomware groups exploit Palo Alto Networks flaw to bypass MFA

Ransomware groups Qilin and INC exploit CVE-2026-0257, a patched Palo Alto Networks authentication bypass, to breach networks, bypass MFA, and steal domain credentials by attacking virtual infrastructure. Security teams should apply the May 2026 fix and hunt for indicators of gateway-connected compromise.

Palo Alto Networks confirmed Monday that ransomware operators Qilin and INC continue to exploit CVE-2026-0257, a patched authentication bypass in PAN-OS and Prisma Access, to breach corporate networks and bypass multi-factor authentication (MFA) controls. The flaw carries a CVSS score of 7.8; CISA added it to the Known Exploited Vulnerabilities catalog on May 13, 2026, after Palo Alto Networks patched it in May 2026.

Unit 42 researchers said Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are weaponizing the vulnerability in financially motivated campaigns. The disclosure follows a ReliaQuest report that detected both Qilin and Settra actively abusing the same flaw. Arctic Wolf flagged Qilin's exploitation in July 2026, describing attacks that ranged from rapid encryption-only strikes to full double-extortion operations.

Attackers exploit the flaw to gain an initial foothold and bypass MFA to establish a VPN session. Once inside, they run internal reconnaissance with dual-use remote monitoring and management tools, move laterally through RDP and SMB connections, and stage tooling for credential harvesting, data exfiltration, and ransomware deployment.

The sharpest tactical shift targets the virtualization layer. In one documented case, attackers moved from a compromised VPN gateway to the vCenter management appliance. From that position, they disabled security controls on ESXi hypervisors by setting execInstalledOnly to false, then deployed a custom tool to perform offline credential dumping directly against a domain controller's virtual disk file (VMDK). The attackers use this technique to bypass in-guest endpoint detection and response (EDR) protections and harvest domain-wide credentials without triggering host-based alerts.

The groups also chain the initial access with exploits against backup infrastructure, abusing CVE-2023-27532 in Veeam systems to maximize damage. Targets span education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation, logistics, utilities, energy, and retail.

Organizations running PAN-OS or Prisma Access should apply the May 2026 patch immediately if they have not already done so. Palo Alto Networks urges security teams to hunt for indicators of compromise tied to gateway-connected events and to initiate incident response protocols upon detection. Because attackers rely on legitimate RMM tools and native protocols like RDP and SMB, defenders should audit VPN session logs, restrict vCenter access, and verify ESXi security settings in addition to endpoint agents.

Source : thehackernews.com