Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access

Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. ReliaQuest reports that multiple threat groups, including Qilin and Settra, are using the flaw to create unauthorized VPN sessions and enter internal networks through trusted remote access services. The activity presents a serious detection challenge because attackers connect through an organization’s own VPN. Their traffic can look like normal remote work, giving them time to steal credentials, move between systems, collect sensitive data, or prepare ransomware before security teams recognize the intrusion. In its threat update, ReliaQuest also reported related activity involving...

Läs hela artikeln hos källan.