NEW DELHI — Ransomware syndicates known as Qilin and INC are actively exploiting an authentication bypass flaw in Palo Alto Networks security products to breach corporate systems, despite the availability of a vendor fix issued in May 2026. The vulnerability allows threat actors to sidestep multi-factor authentication controls and establish illicit virtual private network connections, exposing enterprise networks, virtualization platforms, and core backup systems to intrusion and double extortion.
Tracked as CVE-2026-0257 with a Common Vulnerability Scoring System severity rating of 7.8 out of 10, the weakness affects both PAN-OS and Prisma Access platforms. The vulnerability was incorporated into the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on May 13, 2026, confirming its active weaponization in real-world environments.
Ransomware Operators Expand Network Intrusions
Cybersecurity researchers link the ongoing campaigns to financially motivated actors, identifying Qilin as Spikey Scorpius and INC Ransomware as Tarnished Scorpius. Qilin had previously been observed weaponizing the same flaw in July 2026, but recent activity confirms that both syndicates continue to target unpatched enterprise perimeters.
Intrusions typically begin at vulnerable VPN gateways, where attackers establish an initial foothold before conducting reconnaissance across internal subnets. Perpetrators deploy legitimate remote monitoring and management software to maintain persistent network access and oversee compromised assets. They subsequently navigate between internal machines using common administrative protocols, including Remote Desktop Protocol and Server Message Block, gathering user credentials and staging malicious payloads for widespread operational disruption.
Attackers Infiltrate Virtualization and Core Directory Servers
The intrusions increasingly focus on hypervisor and virtualization infrastructure to maximize administrative leverage. Investigators documented instances where threat actors pivoted from compromised VPN portals directly into VMware vCenter management appliances controlling ESXi hypervisors.
Once inside the management environment, attackers disabled the ‘execInstalledOnly’ security enforcement feature on ESXi hosts. They then used custom utilities to extract credential databases directly from domain controller virtual machine disk files through an offline extraction process. Because this offline extraction circumvents the live operating system, it enables threat actors to evade endpoint detection and response software running inside virtual machines, complicating intrusion monitoring and rapid containment.
Backup Systems Compromised for Extortion Leverage
Threat actors have also targeted enterprise recovery infrastructure, attempting to compromise Veeam backup platforms by leveraging known security vulnerabilities, including CVE-2023-27532. By neutralizing backup repositories, attackers strip organizations of their ability to restore encrypted data independently, leaving victims vulnerable to extortion demands that threaten either the permanent loss or public leak of sensitive enterprise records.
The ongoing intrusion campaign has compromised organizations across a wide range of industries, including healthcare, financial services, education, manufacturing, energy, utilities, retail, logistics, hospitality, government, and professional services. Security teams are advised to deploy vendor updates, monitor perimeter gateways for irregular VPN authentication events, and conduct rigorous forensic inspections across virtualization hosts and directory controllers.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
