Palo Alto Networks Unit 42 says ransomware operators are continuing to exploit CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS and Prisma Access (CVSS 7.8) that lets an attacker set up a VPN connection without valid credentials. In an update published 19 October, Unit 42 attributed the activity to Spikey Scorpius (Qilin) and Tarnished Scorpius (INC), with public reporting also linking operators using Settra ransomware. After establishing a VPN session the attackers bypass MFA, run internal reconnaissance with dual-use RMM tools, move laterally over RDP and SMB, and stage tooling for credential harvesting, exfiltration and eventually ransomware. Unit 42 says the most significant change in tactics is a direct pivot to the virtualization layer: in one case attackers moved from a compromised gateway to the vCenter management appliance, disabled ESXi's execInstalledOnly control and dumped domain credentials offline from a domain controller's VMDK, evading in-guest EDR, and chained the access with Veeam backup flaws (CVE-2023-27532). Palo Alto patched the flaw in May 2026 and CISA KEV-listed it on 13 May.

• Source article