Qilin ransomware is back, and it found the PAN-OS door open
Qilin ransomware dropped off the radar after its last confirmed activity in early June. On July 21, Arctic Wolf Labs ended the quiet period: the group has been exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect VPN, as the initial access vector for new ransomware deployments. Arctic Wolf investigated multiple intrusions throughout June 2026, and every one of them traced back to the same flaw.
If you run GlobalProtect with authentication override cookies enabled, and you have not applied the July 2026 PAN-OS patches, your VPN gateway is the open door.
The vulnerability: CVE-2026-0257
CVE-2026-0257 is rated CVSS 7.8. It affects PAN-OS 10.2, 11.1, 11.2, and 12.1 prior to specific patched builds, plus certain Prisma Access releases. The flaw becomes exploitable under a specific configuration: authentication override cookies enabled alongside a particular SSL certificate setup. When both conditions are present, an unauthenticated attacker can forge a valid-looking VPN session cookie and establish a GlobalProtect session without credentials.
From the network's perspective, that session looks identical to a legitimate remote-access connection. The attacker arrives as an authenticated internal user with whatever network access the GlobalProtect policy grants.
What Qilin did after getting in
Arctic Wolf documented two distinct post-access patterns across the intrusions they investigated.
The first pattern is fast: minimal dwell time, lateral movement directly toward domain controllers, credential harvesting, then ransomware deployment. Total time from initial VPN session to encryption: hours in some cases.
The second pattern is slower and more damaging: extended reconnaissance, broad credential harvesting, and data staging via Rclone to MEGA cloud storage before any ransomware is deployed. This is the double-extortion model: encrypt and exfiltrate, then threaten to publish the stolen data if the ransom is not paid. The Rclone-MEGA staging combination has appeared in multiple Qilin campaigns previously.
Why this matters beyond the patch advisory
Qilin was demoted to Dormant in our threat actor tracker on July 10 after six weeks without confirmed activity. The PAN-OS campaign is the group's return event, and it follows a now-established Qilin pattern: find a freshly disclosed or newly weaponized VPN vulnerability and use it for mass initial access before defenders patch. They did the same thing in May and June with a Check Point VPN flaw.
VPN edge devices remain one of the most reliable initial access paths for ransomware operators because they are internet-facing by design, often not monitored as closely as internal systems, and frequently running software versions that lag behind patch cycles. The authentication override cookie feature is a convenience mechanism that creates a static authentication artifact, exactly the kind of target that makes bypass attacks practical.
What you should do right now
- Patch immediately. Apply the July 2026 PAN-OS builds that address CVE-2026-0257. Affected versions: 10.2, 11.1, 11.2, 12.1. Confirm Prisma Access status separately.
- If you cannot patch within 48 hours, disable authentication override cookies as an interim control. This closes the specific attack surface CVE-2026-0257 targets. Check your GlobalProtect gateway and portal configuration under Device > Certificate Management > Certificate Profile.
- Review GlobalProtect authentication logs for the past 30 days for sessions that did not originate from expected source IP ranges or that authenticated at unusual hours. Qilin intrusions traced back to June, meaning some organizations may have been compromised before awareness of this campaign.
- Check for Rclone on any host that should not have it. Rclone present on servers or domain controllers is a strong indicator of pre-ransomware data staging.
- Review outbound traffic to MEGA cloud storage (mega.nz and its API subdomains). Block it at the perimeter if your organization has no legitimate MEGA usage.
The IoC set from Arctic Wolf's 'Cookie Crumbles' post includes indicators for the specific Qilin infrastructure observed in these intrusions. Retrohunt against your SIEM and EDR telemetry from June 1 onward.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization is assessing its exposure to VPN-edge ransomware campaigns.