Qilin and INC affiliates are using a GlobalProtect flaw to get past multi-factor authentication and into corporate VPNs, then pivoting to VMware.
Multi-factor authentication is one of the best defences an organisation can deploy. But a vulnerability in the device that enforces MFA can quietly take it off the table. That is exactly what is happening with CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect.
Palo Alto Networks' Unit 42 reports that operators linked to the Qilin and INC ransomware groups are exploiting the flaw to establish VPN sessions without passing MFA, gaining an initial foothold inside corporate networks.
How the attacks unfold
Based on Unit 42's reporting and other incident write-ups, the intrusions follow a familiar pattern once the attackers are in:
- An unauthorised VPN session is established through the vulnerable GlobalProtect portal or gateway.
- Attackers move laterally using Remote Desktop Protocol and SMB.
- Additional tools are dropped for credential harvesting and data theft.
- In newer cases, attackers pivot from the VPN gateway to VMware vCenter and ESXi, where encrypting virtual machines causes maximum disruption.
- Ransomware is deployed across the domain.
Victims span education, financial services, healthcare, manufacturing, government and more. The flaw was first patched in May 2026, and exploitation has been observed since shortly after, which shows how long unpatched edge devices stay exposed.
Who is at risk
Exploitation requires specific settings: a GlobalProtect portal or gateway using authentication override cookies, combined with a vulnerable certificate configuration. If your organisation uses GlobalProtect, check both.
What to do now
- Patch PAN-OS to a fixed release and apply Palo Alto's recommended mitigations.
- Review VPN logs for sessions that did not complete an MFA challenge.
- Separate management access to vCenter and ESXi from regular VPN users.
- Hunt for persistence, such as unexpected executables in system folders and remote execution tools like PsExec.
- Test your edge devices regularly. Firewalls and VPN gateways are now the most targeted entry point for ransomware crews.
MFA remains essential. The lesson is that it has to be backed by fast patching of the infrastructure that enforces it.
