Qilin Ransomware Exploits Palo Alto GlobalProtect CVE-2026-0257 for Initial Access

Arctic Wolf Labs investigated several distinct intrusions during June 2026 that all began the same way: exploitation of CVE-2026-0257 against an internet-facing Palo Alto Networks firewall, followed by domain-wide Qilin ransomware encryption. The firm published the findings on July 20, 2026.

What changed with this report is the outcome, not the vulnerability. Earlier coverage from Rapid7 and Arctic Wolf documented unauthorised VPN logins and light internal reconnaissance. This research connects the same entry point to finished ransomware operations across separate victim environments.

Arctic Wolf notes that tradecraft after the initial break-in differed between cases. Some operators encrypted quickly with little dwell time and no data theft. Others spent time on reconnaissance, planted several remote access tools, and exfiltrated data before encrypting. That spread points to multiple affiliates working under the Qilin ransomware-as-a-service model rather than one crew.

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS. Vulnerable builds accept any authentication override cookie they can decrypt, without checking that the appliance actually issued it. An unauthenticated attacker who can obtain the right certificate can therefore forge a cookie for any account, including admin, and open a VPN session with no password and no MFA prompt.

Authentication override is an optional convenience feature. It hands a previously authenticated user a cookie so they can reconnect for a set period without retyping credentials. Palo Alto Networks classifies the underlying weakness as CWE-565, reliance on cookies without validation and integrity checking.

Per Arctic Wolf's June 4, 2026 bulletin, three conditions must all hold for exploitation to succeed: a GlobalProtect portal or gateway is enabled, authentication override cookies are turned on, which is not the default, and the certificate used for those cookies is reused or exposed elsewhere. Reusing the portal HTTPS certificate is the common mistake, because the public certificate chain can simply be retrieved from the exposed service.

Once a session was live, the operators moved fast toward domain control. Arctic Wolf observed VPN sessions opened from hosts self-identifying as kali, with several source IP addresses appearing both as exploitation sources and as session origins. That overlap suggests shared tooling or shared infrastructure across intrusions.

Credential theft came next. The operators dumped LSASS memory through rundll32.exe and comsvcs.dll, writing the output to a .odt file rather than the usual .dmp extension, then pulled the full Active Directory database using ntdsutil.exe with the Install From Media method.

Lateral movement ran on those stolen credentials, mainly through PsExec over administrative shares, with RDP as a secondary path. Before encrypting, the operators cleared their tracks. One routine enumerated every Windows event log channel holding records and cleared each in turn, which wipes peripheral channels such as PowerShell Operational and Task Scheduler, not just Security and System. Microsoft Defender real-time protection was disabled in some cases.

The payload itself was consistent: a binary named win.exe staged in the PerfLogs directory, which exists by default, is rarely watched by file integrity tools, and is often writable without elevation. In double-extortion cases, Rclone moved stolen data to MEGA first, and Veeam backup infrastructure was targeted to remove recovery options.

The advisory lists four PAN-OS trains plus Prisma Access, and neither Panorama nor Cloud NGFW is affected. Fixed builds are 12.1.4-h6 or 12.1.7 for PAN-OS 12.1; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 for 11.2; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 for 11.1; and 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 for 10.2. Prisma Access is fixed at 10.2.10-h36 and 11.2.7-h13, upgraded by Palo Alto Networks on its own schedule.

Exposure is wide in absolute terms. BleepingComputer reported on July 21, 2026 that Shadowserver tracks over 167,000 GlobalProtect instances reachable online, with Shodan finding more than 172,000 IP addresses carrying a GlobalProtect fingerprint. Neither figure says how many are patched, honeypots, or configured with authentication override at all.

One note for administrators planning the upgrade: after patching, the firewall regenerates authentication override cookies using a stronger method, so GlobalProtect users have to re-authenticate once even if they hold a valid cookie. It is a one-time requirement.

Palo Alto Networks disclosed CVE-2026-0257 on May 13, 2026 and updated the advisory on May 29 to state that it had become aware of limited exploit attempts against unpatched devices without mitigations applied. The advisory carries a suggested urgency of Highest and an exploit maturity of Attacked.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 29, 2026, with a remediation due date of June 1 for federal civilian agencies. That three day window is unusually tight and signals how CISA read the risk at the time, well before the ransomware link became public.

Arctic Wolf Labs assesses with moderate confidence that intrusions using CVE-2026-0257 and ending in Qilin ransomware are likely ongoing, citing the volume of scanning activity and the tendency of ransomware-as-a-service models to spread a working exploit across affiliates. Qilin, also tracked as Agenda, has run a double-extortion operation since at least 2022 and claims more than 2,000 victims on its leak site, per BleepingComputer.

Patching is the fix, but patching alone is not enough once a cookie has already been forged. Arctic Wolf's guidance is to upgrade every internet-facing appliance to a fixed build, then follow vendor guidance to terminate all active GlobalProtect sessions so any unauthorised tunnel is dropped immediately.

If an upgrade window is not available yet, the vendor offers two mitigations. Generate a certificate used only for authentication override cookies and share it with nothing else, or uncheck the authentication override options on both the portal and the gateway. The second option costs users more logins and removes the exploit path entirely.

Where exploitation is suspected, Arctic Wolf recommends assuming full domain compromise, because the observed chain reaches LSASS and NTDS quickly. That means rotating domain administrator passwords, service account passwords, cloud storage credentials, and the KRBTGT account twice per Microsoft guidance.

What to hunt for in GlobalProtect logs

The highest signal pattern is a cookie decryption error immediately followed by a clean authentication success in the same session. Also look for successful logins as admin from hosting provider or VPS address space, machine names such as kali, GP-CLIENT or DESKTOP-prefixed Windows defaults, executable creation inside the PerfLogs directory, and PSEXESVC.exe appearing on hosts where PsExec is not sanctioned.

Three things are worth tracking. First, whether other ransomware brands adopt the same entry point: a public proof of concept plus a large exposed install base is the usual precondition, and Qilin affiliates were not the only actors scanning for it.

Second, whether the exposed instance count falls. The Shadowserver and Shodan figures do not separate patched from unpatched devices, so a drop in GlobalProtect fingerprints would be a rough proxy for remediation progress.

Third, whether Arctic Wolf's moderate confidence assessment firms up or fades. The firm said it will update detections and guidance as new intelligence lands, and its indicator set is published openly for defenders to consume.

Exploitation of CVE-2026-0257 gives an unauthenticated attacker interactive network access through a GlobalProtect tunnel. In the cases Arctic Wolf investigated, that access led to full domain compromise and Qilin ransomware encryption within days.

Security: Perimeter authentication controls including MFA are bypassed entirely, because the forged cookie produces a session the firewall treats as already authenticated.

Privacy: In double-extortion cases, data was exfiltrated to MEGA before encryption, creating a disclosure risk for personal and commercial data.

Arctic Wolf Labs tied several June 2026 intrusions ending in Qilin ransomware to CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect that has been patched since May 13, 2026.