Arctic Wolf Labs investigated multiple June 2026 intrusions where threat actors exploited CVE 2026 0257 a Palo Alto GlobalProtect authentication bypass to establish VPN sessions and deploy Qilin ransomware through LSASS dumping NTDS extraction and PsExec lateral movement.

Imagine your Palo Alto firewall sitting at the edge of your network doing its job filtering traffic blocking threats and protecting everything behind it. Now picture that same appliance becoming the front door that threat actors walk right through without ever needing a username or password.

That exact scenario played out across multiple organizations during June 2026 and Arctic Wolf Labs documented every step of what happened next including how quickly a perimeter authentication bypass turned into domain wide encryption and double extortion under the Qilin ransomware banner.

CVE-2026-0257 Exploit Explained

The vulnerability at the center of these intrusions carries the identifier CVE 2026 0257 and scores 7.8 on the CVSS scale which places it in the High severity range. The flaw sits inside the GlobalProtect portal and gateway functionality of Palo Alto Networks PAN-OS and exploits a specific condition involving authentication override cookies when a particular certificate configuration remains active.

When that condition exists an unauthenticated attacker anywhere on the internet can bypass authentication entirely and establish a legitimate looking VPN session against the vulnerable appliance without possessing any valid credentials whatsoever.

Affected version ranges span PAN-OS 12.1 before 12.1.4-h6 or 12.1.7 and PAN-OS 11.2 before multiple hotfix builds and PAN-OS 11.1 before a similarly extensive list of hotfix builds and PAN-OS 10.2 before several distinct hotfix releases.

Prisma Access versions from 10.2.0 through 10.2.10-h35 and 11.2.0 through 11.2.7-h12 also fall within the affected range. Cloud NGFW and Panorama stand as the only confirmed unaffected deployments.

Arctic Wolf identified exploitation activity originating from numerous external IP addresses indicating broad automated scanning specifically targeting vulnerable GlobalProtect deployments rather than hand selected individual victims.

A distinctive detail that appeared across multiple investigated intrusions involves VPN sessions being established from systems whose hostnames self identified as kali suggesting Kali Linux served as the attack platform throughout this campaign. Specific source IPs establishing those kali identified sessions included 108.61.229.217 and 108.61.75.232 and 2.188.33.52 and 199.247.22.193 and 70.34.205.43.

Several of these addresses appeared both as external exploitation sources during the initial scanning phase and as VPN session origins immediately after successful exploitation confirming the same infrastructure handled both stages rather than handing off to a separate post exploitation team.

Once inside the network the attackers moved immediately to establish persistence before anything else. A distinctive registry Run key naming pattern appeared consistently across the investigated intrusions where every persistence entry followed the format of an asterisk followed by exactly six randomized lowercase alphabetic characters.

Arctic Wolf assessed this specific format as potentially representing a Qilin builder configuration artifact rather than a manual choice by individual operators. The execution command embedded in those registry entries pointed directly to the staged ransomware payload at C:\PerfLogs\win.exe with a password parameter and the no-admin flag which skips UAC elevation requests to avoid triggering monitored privilege prompts.

Beyond registry persistence the attackers deployed AnyDesk at multiple different file paths across victim systems suggesting repeated deployment attempts specifically designed to survive path based detection rules.

Ngrok tunneling software appeared alongside a configuration file providing an additional redundant connectivity channel and LogMeIn provided yet another remote access pathway creating a layered persistence approach where losing any single channel would not sever the attackers access.

Credential harvesting followed persistence establishment using two separate techniques that together provided comprehensive authentication material for everything that came next. LSASS process memory dumping used the legitimate rundll32.exe and comsvcs.dll combination to create a memory dump written to a file with an .odt extension rather than the expected .dmp extension a deliberate choice to evade file type based monitoring rules that alert specifically on dump file extensions.

Domain level credential theft went further through ntdsutil.exe using the Install From Media method to create a complete copy of the Active Directory database including every domain account password hash stored at C:\Windows\Temp\NTDS and C:\audit\Active Directory\ntds.dit.

Qilin Ransomware Defense Guide

With domain credentials fully harvested the attackers turned to reconnaissance and lateral movement using a combination of SoftPerfect Network Scanner netscan.exe to identify accessible systems and NetExec nxc.exe to enumerate Windows networks and validate credentials at scale.

PsExec provided the primary execution mechanism with the PSEXESVC.exe service executable appearing at C:\Windows\PSEXESVC.exe across compromised systems. Attackers transferred tools via Windows administrative shares specifically the C$ path to remote Windows Temp directories and then executed them through PsExec establishing a consistent pattern of moving eastward through victim environments using the harvested domain administrator accounts.

RDP provided a secondary lateral movement channel with evidence of both successful and failed connection attempts indicating the attackers were testing which compromised accounts had RDP access to specific high value systems including domain controllers backup infrastructure and file servers.

Before deploying ransomware the attackers systematically destroyed forensic evidence using two distinct log clearing approaches. The more thorough technique used a PowerShell routine that enumerated every registered Windows event log channel filtered for those containing records and cleared each one through the .NET EventLogSession API in a single execution.

This wiped not just the standard Security System and Application logs but also peripheral channels like PowerShell Operational and Task Scheduler logs that investigators rely on after primary logs disappear. A second more targeted approach cleared Security System and PowerShell logs through a threat actor controlled account providing a fallback in environments where the comprehensive PowerShell routine might fail or trigger an alert before completing.

Data exfiltration in the double extortion intrusions used Rclone to transfer stolen data directly to MEGA cloud storage with communications to MEGA infrastructure observed across nodes in Amsterdam Brussels Montreal and Vancouver. ProtonDrive and FileZilla appeared as additional exfiltration tools while Microsoft Defender flagged associated Rclone activity as Behavior:Win32/SuspRclone.

A in some environments. The Veeam backup infrastructure received specific attention before ransomware deployment indicating deliberate targeting to eliminate recovery options before encryption began.

The final Qilin payload consistently named win.exe and staged at C:\PerfLogs\ executed via C:\Windows\SysWOW64\cmd.exe required a 32 character mixed case alphanumeric password at runtime making sandbox detonation significantly more difficult for incident responders trying to analyze the payload before paying ransom.

Arctic Wolf recommends treating patch application for CVE 2026 0257 as an emergency rather than a scheduled maintenance task given confirmed active exploitation. After patching organizations should follow Palo Alto Networks guidance to terminate all active GlobalProtect sessions immediately to invalidate any unauthorized sessions that may already exist.

VPN authentication logs should receive specific hunting attention for sessions from hosting provider IP ranges sessions with kali or Windows-default DESKTOP-ALPHANUMERIC hostname formats and multiple sequential VPN address assignments from the same source in a short window.

If exploitation is confirmed or suspected all domain administrative account passwords the KRBTGT account twice per Microsoft guidance and all service account passwords need immediate rotation because the LSASS and NTDS extraction techniques provide attackers complete domain authentication material within hours of initial access.

C:\PerfLogs should move onto every organizations file integrity monitoring list immediately given its consistent use as a ransomware staging directory across every investigated intrusion. Application control policies that block execution from that directory provide an additional preventive layer.

All Windows Event Logs should forward to a centralized SIEM in real time because the enterprise wide log clearing routine removes local evidence comprehensively enough that local log retention provides no investigative value after a successful intrusion of this type.

Arctic Wolf assesses with moderate confidence that intrusions leveraging CVE 2026 0257 to deploy Qilin ransomware remain ongoing based on extensive scanning activity and the RaaS model’s tendency to distribute successful exploits widely among multiple affiliates once initial exploitation proves reliable at scale.