Multiple Ransomware Groups Exploiting Palo Alto PAN-OS Bug Since June

Multiple ransomware groups have been actively exploiting a high-severity authentication bypass vulnerability in Palo Alto Networks' PAN-OS software since early June, according to Unit 42, the vendor's consulting and incident response division. The attacks have affected organizations across numerous industries, including finance, healthcare, and manufacturing.

The Vulnerability and Exploitation Timeline

CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish unauthorized VPN connections. Palo Alto Networks disclosed and patched the bug on May 13, initially assigning it a medium-severity rating and stating it was aware of attempts to exploit it but had not observed any malicious exploitation.

That assessment changed quickly. By the end of May, Rapid7 researchers reported observing successful exploitation across multiple customer environments, with activity dating back to at least May 17.

Ransomware Groups and Tactics

Andy Piazza, senior director of threat intelligence at Unit 42, said attackers are leveraging the vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication controls to establish a VPN session. Ransomware crews including Qilin and Inc continue to target the CVE, he added.

After gaining initial access, the criminals move laterally across networks using Remote Desktop Protocol and Server Message Block, dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned.

Unit 42 has observed the ransomware criminals infecting organizations across education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail sectors.

ReliaQuest intelligence analysts also warned that multiple threat groups, including Settra ransomware operators, are exploiting the bug to gain initial access to corporate networks via unauthorized VPN sessions.

Virtualization Layer Attacks

Piazza noted that the most significant evolution in tactics is the direct pivot to the virtualization layer. In one notable case, attackers moved from a compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk.

This approach allows attackers to bypass in-guest endpoint detection and response products and represents a highly sophisticated method of stealing domain-wide credentials, Piazza added.

Unit 42 has also observed criminals chaining this exploit for initial access with other vulnerabilities, such as CVE-2023-27532, which targets Veeam backup infrastructure.

Recommendations

Organizations that have not yet patched vulnerable PAN-OS software should do so immediately and investigate whether attackers have already gained access to their networks. Unit 42 has published indicators of compromise to assist with threat-hunting activities.

Palo Alto Networks did not respond to inquiries about the attacks, including how many organizations have been infected.

Sources: The Register