Qilin Affiliates Ride PAN-OS Flaw Into Corporate Networks

There's an old joke among castle historians: the reason medieval sieges took so long wasn't the walls, it was the drawbridge operator. Get to him, bribe him, impersonate him, and the whole fortification becomes theatre. That's roughly what's happening to a set of Palo Alto Networks customers right now. The firewall, the thing you bought specifically to be the drawbridge, is quietly lowering itself for Qilin ransomware affiliates.

And the operators inside don't even know a stranger just walked in wearing a staff uniform.

What Happened

Arctic Wolf Labs spent June 2026 pulling apart a run of intrusions that all led back to the same front door. As CyberSecurityNews reported, every one of those incidents traced back to CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway inside PAN-OS. It carries a CVSS of 7.8, which is the sort of score that gets you a Tuesday morning ticket rather than a phone call at 2am. That scoring, I'd argue, badly undersells what's actually going on.

The flaw only lights up under a specific combination: authentication override cookies enabled together with certain certificate configurations. Get that combo wrong and unauthenticated attackers can skip the login page entirely and stand up VPN sessions that look, to every downstream system, completely legitimate. Affected builds cover PAN-OS 12.1, 11.2, 11.1, and 10.2 prior to the patched releases, and certain Prisma Access versions are in scope too. Palo Alto has confirmed limited active exploitation in the wild.

Once through the drawbridge, the affiliates moved fast. They planted registry Run keys using an oddly specific naming pattern: an asterisk followed by six random lowercase letters. They layered on AnyDesk, Ngrok, and LogMeIn so that losing one channel didn't cost them the network. They pulled credentials out of LSASS via rundll32.exe and comsvcs.dll, disguising the dump as a .odt file. They ripped the entire Active Directory database with ntdsutil.exe. Then PsExec and C$ shares to move sideways, Rclone to MEGA for the exfil, Defender's real-time protection killed, and Windows Event Logs wiped by a PowerShell script that clears every channel on the box, not just Security and System. The ransomware payload, win.exe, sat in C:\PerfLogs\ waiting for a password parameter before it would detonate.

Technical Anatomy

The guts of it: this isn't a memory corruption bug, it isn't a clever chain, it's a logic flaw in the authentication override path. Override cookies exist for legitimate reasons. Admins want a way to keep sessions warm across certificate rotations, avoid locking users out during maintenance, that sort of thing. But the moment you combine that override behaviour with a certain certificate config, the gateway stops asking who you are. Attackers don't crack the door, they walk in holding a cookie that says "already verified, please proceed."

The genius, if you can call it that, is what happens next. The VPN session the attacker stands up is not some hacked-together tunnel that trips anomaly detection. It is a real GlobalProtect session, indistinguishable from a work-from-home developer connecting from a hotel. Every SIEM rule built around "unusual VPN endpoint" or "suspicious auth attempt" politely files it under normal traffic.

From there the affiliates ran a textbook post-exploitation playbook that maps neatly to MITRE ATT&CK: T1547.001 for the Run key persistence, T1003.001 for LSASS dumping, T1003.003 for the NTDS extraction, T1021.002 for the SMB lateral movement, T1567.002 for the Rclone exfil to MEGA. The disguised .odt output is a nice touch. Nobody writes YARA rules for OpenDocument files sitting in a temp directory.

The staging in C:\PerfLogs\ is the bit that tells you these people have watched a lot of Windows EDRs. That folder ships with the OS, has legitimate write activity from Performance Monitor, and is almost universally excluded from active scanning. Combine that with a password-gated payload and you've defeated most automated sandboxing before the sample even runs. The overlap in source IPs between the initial exploit traffic and the later VPN sessions, plus the recurring "kali" hostname, suggests a small pool of shared infrastructure being handed around Qilin affiliates. Same drawbridge trick, different guest each week.

Who Gets Burned

Anyone who's spent a weekend rotating KRBTGT after an AD compromise knows the answer to "who is this bad for" is basically "everyone downstream of a Palo Alto edge box that hasn't been patched." That's a wide net. GlobalProtect is the default remote-access answer for a huge chunk of mid-market financial services, iGaming operators, and payment processors. It's the box that terminates the tunnel for the on-call engineer, the offshore support desk, the third-party integrator with C$ share access to half the fleet.

For iGaming platforms this is a particularly ugly scenario. Regulators in most jurisdictions want to know within hours if player data or wallet balances were touched. If your Event Logs have been wiped across every channel by a PowerShell one-liner, your incident timeline reconstruction just became forensic archaeology, and your regulator conversation gets a lot more expensive. Add the Rclone-to-MEGA exfil pattern and you're looking at a dual-extortion negotiation on top of a compliance investigation.

Fintechs running Prisma Access as their SASE fabric are in the same boat with a bigger blast radius. If the flaw lives in the cloud-delivered gateway, an attacker who bypasses auth there potentially rides through to whatever internal environment is hanging off it. Arctic Wolf's assessment that exploitation is ongoing, driven by widespread scanning, tells you affiliates are farming for the specific misconfiguration right now. The next 90 days will separate the teams that patched last week from the ones still filing change requests.

Ad-tech and enterprise infra companies with acquired subsidiaries are the third category worth flagging. Every acquisition brings its own edge appliances, its own change windows, its own "we'll get to it after the migration" backlog. That backlog is where Qilin lives.

Playbook for Security Teams

Patch CVE-2026-0257 across every internet-facing PAN-OS and Prisma Access instance this week, not next sprint. Then, critically, terminate all active GlobalProtect sessions after the patch lands. A patched gateway with a live pre-patch session is still a compromised gateway. If there's any suspicion of exploitation, rotate domain credentials including KRBTGT twice, on the standard 24-hour gap, because the NTDS extraction gives affiliates the whole hash table to grind offline.

Add a monitoring rule for process execution out of C:\PerfLogs\. There is no legitimate reason for a signed binary to be spawning children from that folder. Same for any registry Run key whose value matches an asterisk followed by six lowercase letters, that's a free detection rule courtesy of the Qilin affiliates' laziness.

Forward Windows Event Logs to a central SIEM in near real time. If the attackers can wipe your local logs after they've already been shipped, they've wiped nothing that matters. Watch for ntdsutil.exe execution outside of documented maintenance windows and rundll32.exe touching comsvcs.dll, which almost never has a benign explanation on a production server. Cross-reference source IPs against the CISA KEV catalogue as the indicators propagate.

The boring bit, but the part where it all falls over if you skip it: audit which of your GlobalProtect deployments actually have authentication override cookies enabled alongside the vulnerable certificate configuration. That combination is the specific tripwire. Turning it off is faster than patching and buys you time.

Key Takeaways

• CVE-2026-0257 lets unauthenticated attackers stand up legitimate-looking GlobalProtect VPN sessions when override cookies meet a specific cert config. The 7.8 CVSS undersells the operational impact.
• Arctic Wolf tied multiple June 2026 Qilin ransomware intrusions to this single entry point, with moderate confidence that exploitation is ongoing.
• Post-exploitation follows a shared RaaS playbook: registry Run key persistence, LSASS dumps disguised as .odt files, NTDS extraction, Rclone-to-MEGA exfil, and full Event Log wipes before the win.exe payload fires from C:\PerfLogs\.
• Patching alone isn't enough. Terminate live GlobalProtect sessions, rotate KRBTGT twice on suspicion, and ship Event Logs off-box before the attackers get to them.
• The drawbridge only works if the operator can't be impersonated. Treat any auth-override feature on an edge appliance as a permanent audit item, not a set-and-forget config.