Qilin Ransomware Exploits PAN-OS Authentication Bypass CVE-2026-0257 for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability, CVE-2026-0257 (CVSS score: 7.8), as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs investigated multiple intrusions in June 2026 that began with exploitation of this authentication bypass flaw affecting the portal and gateway components of PAN-OS software. Successful exploitation allows unauthenticated remote attackers to sidestep authentication and establish VPN sessions without valid credentials when authentication override cookies are enabled with specific certificate configurations.

Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella. Attackers demonstrated consistent operational patterns despite tradecraft variation: staging ransomware at C:PerfLogs, using PsExec for lateral execution via administrative shares, deploying password-protected ransomware payloads, and implementing comprehensive log-clearing routines.

The threat actors weaponized the flaw to gain authenticated access to victim networks by establishing SSL VPN sessions, followed by escalating attacks to facilitate credential harvesting and lateral movement through Windows administrative shares via compromised administrative accounts. The activity is also characterized by attackers taking deliberate steps to clear event logs and disable Microsoft Defender Real-Time Protection prior to running the ransomware payload to minimize detection and avoid leaving forensic evidence.

Despite similarities in ransomware staging paths, PsExec-based execution, and an unusual Windows Registry persistence pattern (an asterisk followed by six randomized lowercase alphabetic characters), follow-on attacks varied across victims. This ranged from enterprise-wide encryption with no data exfiltration and extensive reconnaissance via remote access tools like AnyDesk, Ngrok, or LogMeIn to large-scale credential theft and instances of data exfiltration to the MEGA cloud service before ransomware deployment using Rclone, Proton Drive, and FileZilla.