Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments.
Intelligence analysis by Llama
Qilin ransomware attackers exploited a PAN-OS vulnerability to gain initial access to victim networks, establishing SSL VPN sessions and escalating their attacks to facilitate credential harvesting and lateral movement.
Imagine hackers using a secret backdoor in a company's security system to sneak into the network and install ransomware. They use special tools to move around the network and cover their tracks, making it hard for the company to detect them.
Analysis
Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS software.
Successful exploitation of the flaw allows unauthenticated remote attackers to sidestep authentication and establish VPN sessions without valid credentials when authentication override cookies are enabled with specific certificate configurations. Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.
Attackers demonstrated consistent operational patterns despite tradecraft variation: staging ransomware at C:\PerfLogs, using PsExec for lateral execution via administrative shares, deploying password-protected ransomware payloads, and implementing comprehensive log-clearing routines. The activity is also characterized by the attackers taking deliberate steps to clear event logs and disable Microsoft Defender Real-Time Protection prior to running the ransomware payload so as to minimize the likelihood of detection and avoid leaving forensic evidence.
Despite similarities in ransomware staging paths, PsExec-based execution, and an unusual Windows Registry persistence pattern (i.e., an asterisk followed by six randomized lowercase alphabetic characters), follow-on attacks varied across victims. This ranged from enterprise-wide encryption with no data exfiltration and extensive reconnaissance via remote access tools like AnyDesk, Ngrok, or LogMeIn to large-scale credential theft and instances of data exfiltration to the MEGA cloud service before ransomware deployment using Rclone, Proton Drive, and FileZilla.
"This variability is consistent with RaaS models, in which multiple affiliates may leverage shared initial access infrastructure and ransomware tooling while applying their own preferred post-exploitation methodologies," Arctic Wolf said.
Key points
- Threat actors exploited a now-patched high-severity Palo Alto Networks PAN-OS vulnerability to deploy Qilin ransomware.
- The vulnerability allowed unauthenticated remote attackers to sidestep authentication and establish VPN sessions without valid credentials.
- Attackers demonstrated consistent operational patterns despite tradecraft variation.
- Follow-on attacks varied across victims, ranging from enterprise-wide encryption to large-scale credential theft and data exfiltration.
If the company patches the vulnerability quickly and implements robust authentication practices, they can prevent future ransomware attacks and protect their sensitive data.
If the company fails to patch the vulnerability and implement secure authentication practices, they may be vulnerable to future ransomware attacks, which could lead to significant financial losses and reputational damage.
