The latest disclosure involving Qilin and INC ransomware groups exploiting a vulnerability in Palo Alto Networks PAN-OS highlights a serious cybersecurity concern: what happens when the security infrastructure responsible for controlling access to an enterprise network becomes the attacker's entry point?

According to research published by Palo Alto Networks Unit 42, ransomware operators are actively exploiting CVE-2026-0257, a high-severity authentication bypass vulnerability affecting certain GlobalProtect VPN configurations in PAN-OS and Prisma Access.

The vulnerability, assigned a CVSS score of 7.8, can allow unauthorised VPN sessions to be established by bypassing authentication controls, including multi-factor authentication (MFA), under specific vulnerable configurations.

Although Palo Alto Networks released security fixes in May 2026, exploitation continues months later.

Researchers have identified Qilin, also tracked as Spikey Scorpius, and INC ransomware, tracked as Tarnished Scorpius, among the groups exploiting this weakness.

What makes these attacks particularly concerning is not simply the initial VPN compromise, but the sophistication of the activities that follow.

Attackers are moving beyond conventional ransomware deployment and directly targeting enterprise virtualisation infrastructure, backup systems and domain credentials.

1. Multi-factor authentication is essential, but it is not an absolute security boundary

MFA remains one of the most effective controls against credential-based attacks.

However, this incident demonstrates that MFA cannot protect against every authentication vulnerability.

CVE-2026-0257 affects certain configurations involving GlobalProtect authentication override functionality, allowing attackers to establish VPN sessions without successfully completing the expected authentication process.

This is an important distinction.

The attackers are not necessarily defeating the cryptographic strength of an MFA mechanism. Instead, they are exploiting weaknesses in the surrounding authentication and session-handling implementation.

A strong authentication mechanism can still be undermined by vulnerabilities in the software responsible for enforcing it.

Organisations must therefore evaluate the complete authentication architecture, including session validation, authentication override mechanisms, certificate configurations and access enforcement.

2. A successful VPN connection must not imply unrestricted trust

Traditional remote-access architectures often place considerable trust in users once they successfully establish a VPN connection.

However, if an attacker exploits a vulnerability to establish an unauthorised session, that trust can become dangerous.

Researchers observed attackers using compromised VPN access to conduct internal reconnaissance, identify valuable systems and move laterally using Remote Desktop Protocol (RDP) and Server Message Block (SMB).

These protocols are commonly used for legitimate administration and business operations.

Consequently, malicious activity conducted through them may initially resemble authorised internal communication.

The critical security question is not simply whether a VPN connection is established, but what that connection is subsequently permitted to access.

Organisations should implement strict network segmentation, least-privilege access policies and continuous monitoring of activity originating from remote-access sessions.

3. The most concerning development is the direct attack on virtualisation infrastructure

One of the most significant findings from Unit 42 is the attackers' movement from compromised VPN gateways directly into the virtualisation management layer.

In one investigated incident, attackers accessed a VMware vCenter management appliance and subsequently interfered with security controls on ESXi hypervisors.

They then used a specialised tool to extract credentials directly from a domain controller's virtual disk.

This approach is particularly dangerous because it can bypass security mechanisms operating inside the guest virtual machine.

Traditional endpoint detection and response solutions primarily monitor activity within the operating system.

However, attackers with sufficient access to the hypervisor or virtualisation management infrastructure may interact with virtual machine storage without executing conventional credential-stealing tools inside the protected guest.

When attackers gain control over the virtualisation layer, security controls operating inside individual virtual machines may no longer provide complete visibility.

This demonstrates why hypervisor security, virtualisation management access and infrastructure-level monitoring must be treated as critical components of enterprise cybersecurity.

4. Ransomware operators are increasingly targeting the systems that enable recovery

The reported activity also includes attempts to compromise backup infrastructure, including exploitation efforts involving Veeam and CVE-2023-27532.

This is an important development in modern ransomware operations.

Attackers are no longer interested only in encrypting production servers.

They also attempt to obtain administrative credentials, compromise backup infrastructure, disable security mechanisms and interfere with recovery capabilities.

The objective is to increase the impact of an attack and reduce the victim organisation's ability to restore operations without paying a ransom.

This means that backup servers, management consoles and recovery infrastructure must be protected with the same level of attention as production systems.

Organisations should maintain immutable or otherwise tamper-resistant backups, isolate backup management access and regularly verify recovery procedures.

A backup strategy is only effective if attackers cannot compromise the systems responsible for maintaining and restoring those backups.

5. Endpoint protection alone cannot address every ransomware technique

The use of virtualisation-layer attacks highlights an important limitation of endpoint-centric security architectures.

Endpoint security remains essential for detecting malicious processes, suspicious file activity, credential theft and ransomware execution.

However, attacks against network appliances, management interfaces and hypervisors may occur outside the visibility of conventional endpoint agents.

This reinforces the need for defence in depth.

Network intrusion prevention, internal traffic monitoring, identity security, privileged access management, hypervisor auditing and independent security logging must work together.

For example, unexpected communication from a VPN-connected system to a virtualisation management interface may represent a significant security event, particularly when the connecting identity has no legitimate administrative requirement.

Similarly, unusual SMB activity, unexpected RDP connections and suspicious access to backup infrastructure should be investigated in the context of the user's identity and normal behaviour.

Effective ransomware defence requires visibility across the network, endpoints, identities and infrastructure management layers.

6. Security appliances themselves must be continuously secured

One of the broader lessons from this incident is that firewalls and VPN gateways are not automatically trustworthy simply because they are security products.

These appliances often occupy privileged positions within enterprise networks.

They process external connections, enforce access policies and may have connectivity to sensitive internal infrastructure.

A vulnerability in such a device can therefore have consequences far beyond the appliance itself.

Organisations must maintain strict patch management procedures for security infrastructure, minimise unnecessary management exposure and continuously assess configuration risks.

Security appliance vendors also have an important responsibility to implement secure authentication, session validation, privilege separation and rigorous software security testing.

A security product must be evaluated not only for the threats it can block, but also for its resistance to becoming a threat vector itself.

7. Context-aware access control can help contain compromised sessions

The reported attack chain also reinforces the importance of moving beyond static network access decisions.

A traditional VPN may establish connectivity based on authentication and predefined network permissions.

However, an adaptive access architecture can evaluate additional contextual factors when determining which resources a session should be permitted to reach.

These may include user identity, device characteristics, session behaviour, resource sensitivity and unusual access patterns.

For example, a remote employee who normally accesses business applications should not automatically have access to hypervisor management interfaces, backup infrastructure or domain controllers.

Even if an attacker establishes an unauthorised VPN session, appropriately enforced network segmentation and resource-level authorisation can limit what that session can reach.

Continuous risk evaluation can provide additional protection by identifying suspicious changes in behaviour and triggering further verification or access restrictions.

However, these controls must be enforced independently of the compromised authentication path wherever possible.

Zero Trust is not simply about adding MFA to a VPN. It is about continuously limiting and verifying access to individual resources.

8. Patching is essential, but it does not eliminate an existing compromise

CVE-2026-0257 was patched in May 2026 and added to CISA's Known Exploited Vulnerabilities catalog.

Yet ransomware operators continue to exploit vulnerable deployments.

This demonstrates the operational challenge of ensuring that security updates are applied consistently across distributed enterprise infrastructure.

More importantly, organisations must recognise that applying a patch does not automatically remove an attacker who may have already established access.

If exploitation occurred before remediation, attackers may have obtained credentials, created persistence mechanisms or compromised additional systems.

Organisations should therefore combine patching with proactive threat hunting.

Relevant investigations should include VPN authentication and session records, unusual administrative access, lateral movement, privileged account activity and changes to virtualisation or backup infrastructure.

Where compromise is suspected, affected credentials and sessions should be invalidated and incident response procedures initiated.

9. Ransomware defence must focus on interrupting the complete attack chain

The reported activity illustrates a multi-stage ransomware operation:

Initial exploitation of a vulnerable VPN gateway is followed by unauthorised remote access, internal reconnaissance, lateral movement, credential harvesting, compromise of critical infrastructure and eventual ransomware deployment or data theft.

Each stage creates opportunities for detection and containment.

An organisation may not always prevent the initial exploitation of a vulnerability.

However, effective network segmentation can restrict lateral movement.

Intrusion prevention can detect certain malicious network activities.

Identity monitoring can identify suspicious privileged access.

Data Loss Prevention can help detect or restrict certain unauthorised transfers of sensitive information.

Independent monitoring can help identify suspicious changes to critical infrastructure.

And resilient backup systems can reduce the operational consequences of ransomware deployment.

The objective should not be to depend entirely on a single preventive control, but to create multiple opportunities to detect and interrupt an attack before it reaches business-critical systems.

What does this mean for enterprise cybersecurity?

At GajShield, we believe effective cybersecurity requires a layered, context-aware architecture that extends beyond traditional perimeter protection.

Network firewalls, intelligent intrusion prevention, contextual Data Loss Prevention, DNS intelligence, application security and continuous behavioural monitoring address different aspects of the modern threat landscape.

However, their effectiveness depends on how well they are integrated with identity security, infrastructure protection and operational resilience.

The Qilin and INC ransomware activity demonstrates why organisations must pay particular attention to trusted remote-access infrastructure.

A compromised VPN session should not automatically provide broad internal connectivity.

A legitimate administrative protocol should not be considered harmless simply because it is commonly used within the organisation.

And a protected virtual machine should not be assumed secure if the underlying hypervisor management environment is compromised.

The security architecture must be designed to limit the consequences of individual control failures.

The larger cybersecurity lesson

The exploitation of CVE-2026-0257 demonstrates that ransomware attacks are becoming increasingly focused on weaknesses in trusted infrastructure.

The attacker does not always need to steal a password.

The attacker does not always need to defeat MFA directly.

And the attacker does not always need to execute malicious software inside a protected endpoint.

Sometimes, exploiting a weakness in the authentication infrastructure is sufficient to establish the initial foothold.

From there, inadequate segmentation, excessive privileges and poorly protected management systems can allow the compromise to escalate.

The most important lesson is that successful authentication must never be treated as unlimited authorisation.

A VPN connection should establish only the minimum connectivity required.

Administrative access should remain restricted and independently verified.

Virtualisation and backup infrastructure should be isolated from ordinary user networks.

And security monitoring must extend beyond endpoints to include the infrastructure on which those endpoints depend.

A firewall protects the network perimeter. But when the firewall itself becomes the entry point, the strength of the entire security architecture is tested.

Ultimately, organisations must move from asking:

"How do we prevent attackers from entering our network?"

To asking:

"If an attacker gains entry, how do we prevent that access from becoming a domain-wide compromise?"

Because modern ransomware resilience is not determined by a single firewall, VPN, MFA mechanism or endpoint security product.

It is determined by how effectively the organisation can prevent, detect, contain and recover from an attack, even when a trusted security component fails.

Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was

Source: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA via The Hacker News — published 20 Oct 2026.