Ransomware Groups Qilin and INC Use Palo Alto Networks Vulnerability to Gain Access Despite MFA

Palo Alto Networks has warned that threat actors are still actively exploiting a previously patched security flaw affecting PAN-OS and Prisma Access, with multiple ransomware groups leveraging the vulnerability to gain unauthorized access to enterprise environments.

The vulnerability, tracked as CVE-2026-0257 (CVSS 7.8), is an authentication bypass flaw that allows attackers to establish unauthorized VPN connections and circumvent security controls. Although Palo Alto Networks released patches in May 2026, the bug was subsequently added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog due to confirmed malicious exploitation in the wild.

Qilin and INC Lead Ongoing Exploitation Efforts

According to researchers from Unit 42, ransomware groups Qilin (also known as Spikey Scorpius) and INC (also known as Tarnished Scorpius) continue to weaponize the vulnerability as an initial access vector into corporate networks.

The disclosure follows recent intelligence indicating that financially motivated cybercriminal operations, including Qilin and other ransomware actors, are actively taking advantage of the flaw to infiltrate organizations and launch follow-on attacks.

MFA Bypass Enables Unauthorized VPN Access

Investigators found that attackers are exploiting CVE-2026-0257 to circumvent multi-factor authentication (MFA) protections and establish legitimate-looking VPN sessions within targeted environments.

Once access is obtained, threat actors typically proceed with a series of post-compromise activities designed to expand control across the victim network, increase visibility into critical systems, and prepare for ransomware deployment.

Common Post-Exploitation Activity

Following successful intrusion, attackers have been observed:

• Conducting internal network discovery using legitimate remote monitoring and management (RMM) tools.
• Moving laterally through compromised environments using Remote Desktop Protocol (RDP) and Server Message Block (SMB).
• Deploying additional tools for credential theft and privilege escalation.
• Collecting and exfiltrating sensitive corporate data.
• Preparing ransomware payloads for widespread deployment across affected systems.

Broad Range of Industries Impacted

Campaigns linked to Qilin and INC have affected organizations across numerous sectors, including:

• Education
• Financial Services
• Healthcare
• Technology
• Hospitality
• Manufacturing
• Professional Services
• Legal Services
• Government
• Transportation and Logistics
• Energy and Utilities
• Retail

The diversity of targets highlights the opportunistic nature of these ransomware operations and their focus on organizations with valuable data and critical business functions.

Attackers Increasingly Target Virtualized Infrastructure

Security researchers noted a significant shift in attacker tactics following exploitation of the vulnerability. Instead of focusing solely on endpoint systems, threat actors are increasingly pivoting directly into virtualization environments.

In one incident, attackers reportedly moved from a compromised VPN gateway to a vCenter management server. After gaining access, they disabled security mechanisms on VMware ESXi hypervisors and utilized custom tooling to perform offline credential extraction against virtual machine disk files (VMDKs).

By targeting virtualization infrastructure directly, attackers can bypass many traditional endpoint detection and response (EDR) solutions that are designed to monitor operating systems rather than hypervisor-level activity.

This technique enables threat actors to obtain highly privileged domain credentials while minimizing the likelihood of detection.

Backup Infrastructure Also Under Attack

Researchers have additionally observed attackers combining CVE-2026-0257 exploitation with other publicly known vulnerabilities to maximize operational impact.

One recurring tactic involves targeting Veeam backup environments through exploitation of CVE-2023-27532, allowing attackers to compromise or disable backup systems before deploying ransomware. This strategy can significantly hinder recovery efforts and increase pressure on victims to pay extortion demands.

Previous Warnings Linked Qilin to the Vulnerability

Security firm Arctic Wolf previously reported Qilin's use of CVE-2026-0257 in attacks observed during mid-2026. Those incidents ranged from rapid encryption-focused operations to more sophisticated double-extortion campaigns involving both data theft and ransomware deployment.

Palo Alto Networks Urges Immediate Action

Although patches have been available for several months, Palo Alto Networks warns that exploitation remains active and organizations should not assume they are safe simply because the vulnerability is no longer new.

The company recommends that organizations:

• Apply all available PAN-OS and Prisma Access security updates immediately.
• Review VPN and gateway logs for suspicious authentication activity.
• Hunt for indicators of compromise associated with CVE-2026-0257 exploitation.
• Investigate any successful VPN connections that appear unusual or unauthorized.
• Initiate incident response procedures if evidence of compromise is discovered.
• Strengthen monitoring around virtualization infrastructure, backup systems, and privileged accounts.

The continued abuse of CVE-2026-0257 underscores how rapidly ransomware groups weaponize perimeter vulnerabilities, particularly those capable of bypassing MFA and providing direct access to enterprise networks. Organizations that have not yet patched affected systems face an elevated risk of credential theft, lateral movement, data exfiltration, and ransomware deployment.