Organizations may already have unauthorized VPN sessions created through a patched GlobalProtect authentication bypass. Ransomware operators including Qilin and Inc have been linked to exploitation, while public reporting also connects Settra activity. Attackers used the access to bypass multifactor authentication and enter corporate networks. In one investigation, they moved toward virtualization infrastructure and extracted credentials from a domain controller’s virtual disk.
What Happened
Ransomware operators are exploiting an authentication bypass in vulnerable PAN-OS GlobalProtect portals and gateways to establish unauthorized VPN connections. The issue, CVE-2026-0257, was disclosed and patched in May and added to CISA’s Known Exploited Vulnerabilities catalog on May 13. Palo Alto Networks later reported limited exploitation attempts against unpatched devices, and its incident responders have investigated related intrusions since early June.
An October update linked exploitation attempts to ransomware operators including Qilin and Inc. Public reporting also connected Settra ransomware activity. The weakness can let an unauthenticated attacker bypass security controls and create a VPN session. Unit 42 said only a small portion of probed devices established sessions in its observations, but a successful gateway-connected event changes the situation from exposure to possible intrusion.
Updated investigations showed attackers using the VPN foothold to bypass multifactor authentication, explore internal networks and pursue credentials and data before ransomware deployment. In one case, attackers moved from the compromised gateway to the vCenter management appliance, disabled controls on ESXi hypervisors and used a custom tool to extract credentials offline from a domain controller’s virtual disk. Investigators also observed attackers combining the access with tools aimed at Veeam backup infrastructure.
Why It Matters
The danger is not limited to the VPN appliance. A session created through a trusted remote-access service can resemble legitimate employee activity and may escape attention until credential theft, lateral movement, data theft or ransomware deployment is underway. That gives attackers an entry path that may already sit inside normal operational workflows.
The move toward virtualization infrastructure is especially important because activity against virtual disks can bypass security controls running inside guest operating systems. Access to domain credentials, hypervisor management or backup infrastructure can increase the potential impact across many systems at once. Organizations in healthcare, education, government, energy and other sectors were represented in the reported investigations.
Patching remains essential, but it does not invalidate a session or credential obtained before remediation. Leaders should therefore treat this as both a vulnerability-management task and a possible incident-response task.
What to Watch
Organizations should watch for successful gateway-connected events associated with suspicious device names, host identifiers or reported infrastructure. Connections using unexpected hostnames such as kali were specifically highlighted in the supplied reporting. Internet exposure created by GlobalProtect profiles mapped to management interfaces, including ports 4443 and 3879, also deserves verification.
If attackers established access, subsequent signals may appear in vCenter, ESXi, domain controller, backup or remote-management telemetry. One assessment expected exploitation to continue as ransomware groups and initial-access brokers searched for unpatched systems. Continued activity is therefore plausible where patches or mitigations remain absent, but each organization should base escalation on its own connection and host evidence.
What Defenders Should Do
Immediate action: follow the vendor advisory and install a fixed version or apply the available mitigations. Disable authentication override cookies where they are not required, and verify that management interfaces are not unintentionally exposed through GlobalProtect service mappings.
Session control: terminate all active GlobalProtect sessions after remediation so access established before patching does not remain valid. Review successful gateway-connected events, not only failed attempts, and activate incident-response procedures for suspicious successful sessions.
Investigation: search GlobalProtect logs for the supplied indicators, unexpected device details and unusual connection patterns. If suspicious access is found, expand the review to identity systems, vCenter, ESXi hosts, domain controllers, Veeam infrastructure and legitimate administration tools that could support lateral movement. Examine whether credentials were accessed or security controls were changed.
Recovery: reset affected credentials, validate backup integrity and confirm that attackers cannot return through another active account or session. Treat patch completion as one milestone in the response rather than proof that the environment is clean.
The Larger Lesson
Remote-access infrastructure combines internet exposure, identity trust and a direct path into internal networks. When attackers exploit that layer, their activity can inherit the appearance of legitimate work and reduce the value of controls that assume the VPN session is trustworthy.
The durable lesson is to pair rapid edge-device patching with session revocation and retrospective hunting. An organization that fixes the device but does not investigate earlier successful access may leave the most important part of the incident unresolved.