Qilin exploits Palo Alto Networks GlobalProtect VPN firewalls

Qilin was observed leveraging Palo Alto Networks GlobalProtect VPN firewalls to drop ransomware and conduct data exfiltration against unspecified victims.In a July 20 blog post, Arctic Wolf Labs shared that its researchers saw a series of intrusions in June 2026 that culminated in Qilin ransomware deployment. All the cases originated from the exploitation of CVE-2026-0257 (CVSS 9.1) as the initial access vector, said the researchers.Palo Alto Networks originally shipped a fix for CVE-2026-0257 on May 13 and disclosed exploit attempts the same day. Rapid7 saw broad exploitation by May 17 and then the Cybersecurity and Infrastructure Security Agency (CISA) gave federal agencies three days to act when it added the flaw to the KEV catalog on May 29.Arctic Wolf reported that the ransomware deployments took place in June, several weeks after a patch existed and after a federal directive spelled out the urgency.“The harder problem and the reason those exploitation dates matter is that patching now does not evict an attacker who established a session in May,” said Bradley Smith, senior vice president and Deputy CISO at BeyondTrust. “This flaw let attackers create unauthorized VPN connections, so the compromise looks like a legitimate login rather than an exploit artifact, and Arctic Wolf’s observation that tradecraft varied across affiliates means indicator matching alone will miss intrusions.”Smith said any teams running GlobalProtect should review their VPN session and account activity back to May 13. Shadowserver counts over 167,000 of these portals exposed to the internet, and nobody can say how many are patched — and that’s why Smith said teams need to act.“Palo Alto released patches on 13 May, exploitation was observed four days later, and the ransomware intrusions occurred during June,” said Rogier Fischer, co-founder and CEO at Hadrian. “Customers did not suddenly need to patch when the ransomware connection became public in July, they needed to patch two months earlier.”Fischer said we often describe security as a game of cat and mouse, but attackers will continue to focus on systems whose decisions are implicitly trusted by everything behind them.“Layered controls and repeated verification do not remove the need to patch quickly, but they can prevent one compromised trust decision from becoming a direct path to ransomware,” said Fischer.Shane Barney, chief information security officer at Keeper Security, added that what we’re seeing with CVE-2026-0257 and Qilin isn’t a compressed timeline so much as the disclosure-to-exploitation cycle working exactly as attackers have engineered it to work.“That gap between guidance and action is precisely the window ransomware operators are counting on,” said Barney. “What matters about RaaS operations like Qilin is that once a reliable exploit is in the wild, affiliates move fast and independently.”Barney pointed out that some of these intrusions went from VPN authentication bypass to full encryption with minimal dwell time, while others involved weeks of credential harvesting, reconnaissance and data exfiltration before the ransomware payload dropped. The timeline varies considerably depending on the affiliate and their objectives, but domain compromise is the consistent destination, said Barney.“A GlobalProtect authentication bypass doesn’t just give an attacker a foothold, it gives them an authenticated session inside the network perimeter before any internal controls have a chance to respond,” said Barney. “From there, credential dumping and lateral movement through administrative shares follow a well-documented playbook, and the organizations that discover this gap tend to do so only after the damage is done.”Suzu Labs CTO Denis Calderone, chief technology officer at Suzu Labs, added that the cadence from disclosure to actual ransomware being dropped represents the state-of-affairs right now, and it’s worth understanding why.Calderone said the accelerant is not the disclosure: it’s the public exploit code. When Palo Alto first put this out, Calderone said it carried a soft score in the 4s and drew only a low-and-slow trickle of exploitation. The moment a working proof-of-concept and technical writeup went public at the end of May, Calderone pointed out that the score was revised up to 7.8, CISA added it to the KEV the same day, and exploitation surged.“Weaponized exploit code is what compresses the timeline, and the advisory alone barely moves the needle until that drops,” said Calderone. “It also helps that a VPN gateway is the prize, because it’s the front door to the entire network. Once a working proof-of-concept is public, the break-in gets commoditized. Everyone with intent and a computer runs the same play against the same bug, so that phase is fast and uniform, and it’s what dominates the news and feels instant.”Calderone said what happens after they are inside is where individual actors take over. Arctic Wolf saw this one bug lead to Qilin ransomware at wildly different tempos, said Calderone, some affiliates encrypting within hours, others sitting inside for weeks harvesting credentials and exfiltrating data first. Same entry point, different goals, different speed, because Qilin is RaaS and every affiliate runs their own playbook.“End to end this was closer to six weeks than the overnight story it feels like, and that variable middle stretch is the real detection window,” said Calderone. “Patch, then terminate sessions after patching, rotate credentials including the KRBTGT account [in Active Directory], and hunt for lateral movement.”