Ethical Hacking News
Ransomware groups Qilin and INC have successfully exploited a previously undisclosed vulnerability in Palo Alto Networks' PAN-OS and Prisma Access systems. This vulnerability, identified as CVE-2026-0257, allows attackers to bypass MFA controls and establish a VPN session, giving them access to internal network reconnaissance, lateral movement, and other malicious activities. Organizations are advised to apply the latest fixes, hunt for indicators of compromise, and initiate incident response protocols to mitigate the risks associated with this vulnerability.
Recently discovered vulnerability CVE-2026-0257 in PAN-OS and Prisma Access systems has been exploited by ransomware groups Spikey Scorpius and Tarnished Scorpius. The vulnerability allows bypassing multi-factor authentication (MFA) controls and has been found in use by these two groups. Palo Alto Networks had been observing the exploitation of the vulnerability since May 2026 and added it to its KEV catalog on May 13, 2026. Researchers have identified the tactics, techniques, and procedures (TTPs) employed by the threat actors, including gaining initial foothold, bypassing MFA, and conducting internal network reconnaissance. Organizations are recommended to take proactive measures to prevent exploitation, including applying the latest fixes, hunting for indicators of compromise, and initiating incident response protocols. The exploitation of CVE-2026-0257 serves as a reminder of the ongoing cat-and-mouse game between cybersecurity vendors and threat actors, and the importance of staying vigilant and proactive.
A recent revelation in the realm of cybersecurity has shed light on a previously undisclosed vulnerability in the PAN-OS and Prisma Access systems by Palo Alto Networks. This vulnerability, identified as CVE-2026-0257 with a CVSS score of 7.8, has proven to be a game-changer for the nefarious actors in the cybercrime world. The exploit, which is capable of bypassing multi-factor authentication (MFA) controls, has been found to be utilized by two prominent ransomware groups, Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC).
The story of Qilin and INC began to take shape in May 2026, when Palo Alto Networks disclosed that it had been observing the exploitation of the aforementioned vulnerability. It was then revealed that the activity related to this vulnerability had been ongoing, with both Qilin and INC actively utilizing it in their financially-motivated attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CSIA) had also taken notice of the vulnerability, adding it to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
Researchers from Unit 42 shed more light on the tactics, techniques, and procedures (TTPs) employed by the threat actors. According to them, the attackers were utilizing the vulnerability to gain an initial foothold into corporate networks and then bypassing MFA controls to establish a VPN session. This session was then used to conduct internal network reconnaissance using dual-use remote monitoring and management (RMM) tools, move laterally across the network via RDP and SMB, stage additional tooling for credential harvesting, data exfiltration, and ransomware deployment, and ultimately, execute a post-compromise activity that allowed them to disable security controls on ESXi hypervisors and perform offline credential dumping directly against a domain controller's virtual disk (VMDK).
The approach taken by the attackers circumvented in-guest endpoint detection and response (EDR) and security protections, allowing them to obtain domain-wide credentials. Moreover, they had also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws to inflict maximum damage.
Palo Alto Networks recommended that organizations take proactive measures to prevent exploitation. These measures included applying the latest fixes, hunting for indicators of compromise, and initiating appropriate incident response protocols if successful gateway-connected events were detected.
In a broader context, the vulnerability has brought attention to the ongoing cat-and-mouse game between cybersecurity vendors and the nefarious actors. It serves as a stark reminder of the importance of staying vigilant and proactive in the face of emerging threats.
The exploitation of CVE-2026-0257 by Qilin and INC marks a concerning development in the world of cybersecurity. As the threat landscape continues to evolve, it is essential for organizations to remain vigilant and take proactive steps to mitigate the risks associated with this vulnerability.
The revelation of this vulnerability and its exploitation by Qilin and INC has far-reaching implications for the cybersecurity community. As the threat actors continue to evolve and adapt, it is crucial for vendors and organizations alike to stay abreast of the latest developments and take proactive measures to protect against emerging threats.
In conclusion, the story of Qilin and INC serves as a stark reminder of the importance of staying vigilant in the face of emerging threats. As the cybersecurity landscape continues to evolve, it is essential for organizations to remain proactive and take steps to mitigate the risks associated with vulnerabilities like CVE-2026-0257.
Related Information:
https://www.ethicalhackingnews.com/articles/Ransomware-Exploits-The-Tale-of-Qilin-and-INC---A-Vulnerability-Bypassed-by-Palo-Alto-Networks-ehn.shtml
https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
Published: Tue Oct 20 15:01:03 2026 by llama3.2 3B Q4_K_M
