Palo Alto Networks has revealed ongoing exploitation of a recently patched security vulnerability affecting PAN-OS and Prisma Access by various ransomware actors. This disclosure has raised concerns within the cybersecurity community regarding the implications of these attacks, especially as many organizations are still grappling with the nuances of the security flaw.
The vulnerability in question, identified as CVE-2026-0257, has a CVSS score of 7.8. It poses a significant risk due to its ability to enable unauthorized VPN connections, thereby allowing malicious actors to circumvent security protocols. Palo Alto Networks addressed this flaw in May 2026, subsequently prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to catalog it as a known exploited vulnerability as of May 13, 2026.
In a recent update, researchers from Unit 42 noted that ransomware groups, particularly those known as Spikey Scorpius (also referred to as Qilin) and Tarnished Scorpius (also known as INC), have been actively exploiting CVE-2026-0257. This alarming trend was highlighted shortly after ReliaQuest pointed out the exploitations of both Qilin and another group, Settra, indicating a more severe trend in financially motivated cyberattacks.
The exploitation of this vulnerability marks a pivotal moment for threat actors, allowing them to gain initial access to corporate networks. Once inside, attackers can bypass multi-factor authentication (MFA) controls, leading to the establishment of a VPN session. This initial foothold is critical, as it allows attackers to conduct various post-compromise activities aimed at maximizing their control over the compromised systems.
Upon successfully setting up a VPN session, threat actors typically engage in several sophisticated maneuvers:
-
Internal Network Reconnaissance: Utilizing dual-use remote monitoring and management (RMM) tools, attackers can survey the network landscape.
-
Lateral Movement: They leverage Remote Desktop Protocol (RDP) and Server Message Block (SMB) protocols to navigate through the network.
- Tooling Stage: Subsequently, they stage additional tools designed for credential harvesting, data exfiltration, and the deployment of ransomware, thus further entrenching their presence.
These attacks span a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation, logistics, utilities, energy, and retail. The diverse sectors targeted underscore the pervasive threat posed by ransomware.
Unit 42 highlighted a notable evolution in the tactics employed by ransomware groups following the exploitation of CVE-2026-0257. They have observed a direct pivot to the virtualization layer, which illustrates the sophistication of the threats posed. In one instance, attackers transitioned from the compromised VPN gateway to the vCenter management appliance, allowing them to disable security controls on ESXi hypervisors and utilize a custom tool for offline credential dumping from a domain controller’s virtual disk. This method effectively evades in-guest endpoint detection and response (EDR) mechanisms, enabling attackers to secure domain-wide credentials with minimal detection.
Moreover, attackers have been seen chaining their initial access with additional exploit tools aimed at Veeam backup infrastructure, where they exploit known vulnerabilities to exacerbate the damage inflicted on the organizations. This approach to attack highlights a troubling trend where threat actors utilize multiple vectors to maximize their impact.
It is also noteworthy that Qilin’s use of CVE-2026-0257 was previously flagged by Arctic Wolf in July 2026, suggesting that the ransomware group has been exploring various strategies since the vulnerability was disclosed. The nature of their attacks has varied, ranging from rapid encryption-only operations to implementing full double-extortion tactics.
In light of these developments, Palo Alto Networks has strongly urged organizations to not only implement the latest patches but also to actively seek out indicators of compromise within their systems. Furthermore, a proactive approach to incident response is essential, especially if any suspicious activity surrounding gateway-connected events is detected.
This situation underscores the critical need for robust cybersecurity measures and vigilance as ransomware tactics grow increasingly sophisticated and multifaceted.