Qilin Ransomware Exploits PAN-OS GlobalProtect: 167K Firewalls Targeted

CVE-2026-0257 exploits a cryptographic trust boundary failure in PAN-OS GlobalProtect's authentication override cookie mechanism. GlobalProtect uses authentication override cookies to allow users to bypass repeated authentication prompts during a VPN session. When a firewall reuses the same certificate for both cookie encryption/decryption and another function such as HTTPS, an attacker can discover the public key and forge arbitrary authentication override cookies for any user.

A public proof-of-concept tool called forge_cookie.py is already circulating and automates the forging process. Attackers establish VPN sessions from Kali Linux systems, meaning incident responders identifying unexpected Linux-sourced VPN sessions should treat them as high-confidence compromise indicators. Rapid7 MDR observed a second exploitation wave on May 21, with consistent MAC addresses suggesting the same threat actor conducted both waves before patches were released.

After gaining authenticated VPN access, Qilin affiliates execute a consistent post-exploitation playbook documented across Arctic Wolf Labs' investigated intrusions. Credential harvesting begins with LSASS memory dumping using rundll32.exe and comsvcs.dll, with the dump output disguised as a .odt file to evade detection. Active Directory database extraction follows via ntdsutil.exe, giving the attacker a complete offline copy of all domain credentials. Lateral movement uses PsExec and RDP. Persistence is established through registry Run keys and scheduled tasks. Remote access tools including AnyDesk, Ngrok, LogMeIn, and MeshAgent are deployed for long-term operator access. Data exfiltration uses Rclone to MEGA cloud storage in double-extortion cases. Windows event logs are cleared before final ransomware deployment.

Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, suggesting multiple affiliates operating under the Qilin ransomware-as-a-service umbrella rather than a single coordinated team.

Qilin has accumulated 1,358 confirmed victims in 2026, up 443% year over year. ZeroFox assessed Qilin as the most active ransomware collective globally through Q2 2026. The collective claimed 15 new victims across nine countries in a single five-day period in early June alone.

North America represents 53.9% of all Qilin victims, with the United States appearing most frequently, followed by Canada, the United Kingdom, France, and Germany. The sector distribution reveals a deliberate targeting strategy that favors organizations with low downtime tolerance and high likelihood of payment.

Healthcare is Qilin's third most targeted sector with 168 confirmed victims, behind manufacturing at 291 and business services at 245. Education and media organizations appear regularly across Qilin's leak site. The CVE-2026-0257 attack chain specifically enables these sector concentrations: GlobalProtect is widely deployed in healthcare networks requiring HIPAA-compliant remote access, in manufacturing environments connecting distributed facilities, and in educational institutions managing remote workforce and student access.

The double-extortion model applied by Qilin affiliates in a subset of intrusions intensifies the financial pressure on healthcare and education targets. Patient records, student data, and proprietary manufacturing processes represent highly sensitive categories that organizations cannot afford to have publicly leaked, increasing Qilin's leverage beyond the ransomware encryption alone. This pattern mirrors the VPN credential theft pipeline that INC ransomware affiliates ran against FortiGate devices earlier this month: initial access via enterprise VPN exploitation, credential harvesting, and ransomware deployment.

Qilin (also known as Agenda) is a sophisticated Russian-language ransomware-as-a-service collective that first appeared in 2022. Bitdefender believes Qilin has Russian roots, with a founding member communicating in Russian and English on Russian-speaking cybercrime forums. The collective operates under a ransomware-as-a-service model, recruiting technical affiliates who gain access to Qilin's ransomware binary, infrastructure, and leak site in exchange for a percentage of ransom payments.

The RaaS structure explains the operational variation observed by Arctic Wolf Labs across CVE-2026-0257 intrusions: different affiliates operate at different speeds and choose different extortion models. Some affiliates execute encryption-only operations rapidly after gaining access, while others invest in extended dwell time for data exfiltration. This variation means defenders cannot rely on a consistent timing signature to detect Qilin intrusions and must treat any confirmed initial access as an immediate emergency.

Qilin claims victims publicly on a Tor-hosted leak site, where organizations that do not pay within the demanded timeframe have their stolen data published. This leak site functions both as extortion pressure and as the public record of Qilin's victim count, which security researchers use to track activity levels. The 443% year-over-year increase in claimed victims reflects both organic growth in the affiliate program and the increased effectiveness of initial access methods like CVE-2026-0257 that require no phishing, no social engineering, and no insider access.

The CVE-2026-0257 exploit eliminates the hardest step in most ransomware attack chains: gaining an initial foothold. With 167,000 exposed GlobalProtect instances and a public proof-of-concept already circulating, the barrier to initial access for Qilin affiliates targeting unpatched organizations is now a single crafted HTTP request.

The indicators below reflect the confirmed post-exploitation pattern documented by Arctic Wolf Labs across multiple Qilin intrusions entering through CVE-2026-0257. Network-level indicators focus on the VPN session forgery. Host-level indicators cover credential harvesting and persistence. These indicators reflect Qilin's documented behavior; individual affiliates may vary specific tooling.

Organizations should check GlobalProtect authentication logs for characteristics of CVE-2026-0257 exploitation: VPN sessions authenticated without challenge-response interaction, sessions originating from IP addresses with no prior connection history to your organization, and sessions established from Kali Linux user agents or operating system fingerprints. Similar enterprise VPN exploitation patterns were also documented in the SonicWall SMA1000 zero-day attacks that preceded this Qilin campaign.

No CVE-2026-0257-specific Sigma detection rule exists in the SigmaHQ community repository. Detection coverage for this campaign relies on behavioral rules that catch Qilin's post-exploitation credential harvesting, which occurs after the authentication bypass grants VPN access.

Two rules directly cover Qilin's documented credential theft techniques. The comsvcs.dll memory dump rule catches the exact rundll32.exe invocation Arctic Wolf Labs documented across Qilin intrusions. The ntdsutil.exe rule catches Active Directory database extraction, which Qilin affiliates use to obtain offline access to every domain credential. Both rules require Windows endpoint detection telemetry with process creation events. Deploy them to any system monitoring domain controllers and member servers, where Qilin affiliates perform credential harvesting after establishing their VPN foothold.

Patching CVE-2026-0257 requires upgrading to a fixed PAN-OS version and verifying that authentication override cookie certificates are not shared with other services. Palo Alto Networks published the official security advisory at security.paloaltonetworks.com/CVE-2026-0257 with complete version guidance. CISA required federal agencies to remediate by June 1, 2026. Enterprise organizations should treat that deadline as already passed and act without delay.

The six steps below apply to any organization running PAN-OS GlobalProtect with authentication override cookies enabled.

Enterprise VPN appliances are the most valuable initial access point for ransomware operators: they are internet-facing by design, they authenticate directly into the internal network, and successful exploitation requires no user interaction. CVE-2026-0257 reduces the entire first phase of a Qilin ransomware intrusion to a single crafted HTTP request against an exposed GlobalProtect endpoint.

The 167,000 exposed GlobalProtect instances that Shadowserver tracks represent the realistic scope of the target population. Organizations that have not applied patches since May 30 remain in this population, exposed to a public exploit, an active criminal RaaS with 1,358 confirmed victims in 2026, and a post-exploitation playbook that moves from initial VPN access to full Active Directory compromise in a documented, repeatable sequence.

Healthcare organizations face particular urgency. Qilin has confirmed 168 healthcare sector victims and actively targets the sector for its combination of sensitive data value and operational downtime intolerance. A Qilin intrusion through CVE-2026-0257 that reaches a healthcare domain controller extracts every credential in the organization's Active Directory. Patient data, connected clinical systems, and EHR integrations all fall within the blast radius of that single credential compromise.

The GlobalProtect authentication bypass pattern is not isolated to Qilin. Any other ransomware group or initial access broker scanning for CVE-2026-0257-vulnerable instances uses the same forge_cookie.py tooling and the same certificate key discovery method. Patching CVE-2026-0257 closes the initial access vector for all of them simultaneously.