Qilin and INC ransomware gangs exploit PAN-OS flaw to slip past MFA

Two of the most active ransomware operations, Qilin and INC, are exploiting a Palo Alto Networks vulnerability to gain VPN access to corporate networks while sidestepping multi-factor authentication, according to The Hacker News, which reported on an exploitation update published by the company's Unit 42 threat intelligence team. The flaw, tracked as CVE-2026-0257, was patched in May 2026, which means organizations that still run unpatched gateways are directly exposed to attacks that end in data theft and encryption.

What happened

According to The Hacker News, Unit 42 attributes the activity to Spikey Scorpius, its name for the Qilin ransomware operation, and Tarnished Scorpius, which corresponds to INC Ransom. The attackers exploit the vulnerability to obtain an initial foothold, bypass MFA controls and establish an unauthorized VPN session into the victim's environment.

The report places the update in a longer timeline. Palo Alto Networks released fixes in May 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 13, 2026. In July, Arctic Wolf reported Qilin attacks leveraging the bug that ranged from encryption-only incidents to full double extortion, and days before the Unit 42 update ReliaQuest reported exploitation by Qilin and the Settra ransomware group, The Hacker News said.

Technical details

The Hacker News describes CVE-2026-0257 as an authentication bypass with a CVSS score of 7.8 that affects PAN-OS and Prisma Access and can allow attackers to set up unauthorized VPN connections. Once connected, the intruders performed internal reconnaissance with dual-use remote monitoring and management tools, moved laterally over RDP and SMB, and staged tools for credential harvesting, data exfiltration and ransomware deployment.

In one case highlighted by Unit 42, the attackers pivoted from the VPN gateway to the vCenter management appliance, disabled security controls on ESXi hosts and used a custom tool to extract credentials offline from a domain controller's virtual disk. Unit 42 says this approach evades endpoint detection running inside the guest operating system. Some intrusions were also chained with exploitation of Veeam backup infrastructure through CVE-2023-27532, a combination aimed at maximizing damage by targeting recovery capabilities.

Who is affected

The report lists a wide range of targeted sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. The Hacker News did not name individual victims. Any organization running unpatched PAN-OS or Prisma Access deployments is potentially at risk.

What to do

Unit 42 recommends applying the latest PAN-OS and Prisma Access fixes, proactively hunting for indicators of compromise listed in its advisory, and initiating incident response procedures if suspicious events connected to the gateway are detected. Because the attack chain bypasses MFA, defenders should not rely on MFA logs alone. Reviewing VPN session records, vCenter and ESXi configuration changes, and access to backup servers, as well as patching Veeam Backup & Replication against CVE-2023-27532, can help limit the impact of a successful intrusion.