"Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC)," Unit 42 researchers said in an update shared on Monday.
CVE-2026-0257: an authentication bypass patched in May 2026
Palo Alto Networks disclosed ongoing exploitation of CVE-2026-0257, an authentication-bypass flaw affecting PAN-OS and Prisma Access. The vulnerability carries a CVSS score of 7.8 and was patched by Palo Alto Networks in May 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CSIA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
Qilin and INC weaponize the flaw to create unauthorized VPN sessions
Unit 42 and other vendors report that ransomware operators — specifically Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC) — have used the flaw to gain an initial foothold. After exploiting the authentication bypass, the attackers establish unauthorized VPN connections and then "bypass multi-factor authentication (MFA) controls to establish a VPN session," according to Unit 42.
ReliaQuest had previously said it detected both Qilin and Settra actively exploiting the flaw in financially-motivated attacks, a disclosure that predated Unit 42’s update by days. Arctic Wolf earlier flagged Qilin's exploitation of CVE-2026-0257 in July 2026, noting attacks that ranged "from rapid encryption-only operations to full double-extortion."
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePost-compromise activity: virtualization-layer pivot and offline credential dumping
After successful gateway compromise, Unit 42 documents a set of repeatable post-compromise behaviors. Attackers conduct internal reconnaissance using legitimate remote monitoring and management (RMM) tools, move laterally via RDP and SMB, and stage tooling for credential harvesting, data exfiltration, and ransomware deployment.
Unit 42 emphasized a notable evolution in the adversaries' tactics: "The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer." In one described case, attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled security controls on ESXi hypervisors (execInstalledOnly), and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK). That approach allowed attackers to circumvent in-guest endpoint detection and response (EDR) protections and obtain domain-wide credentials.
Chaining exploits and the range of targeted sectors
Unit 42 also observed adversaries chaining the initial VPN-gateway exploitation with other known exploit tools. Notably, attackers made efforts to target Veeam backup infrastructure by abusing known flaws (CVE-2023-27532) — an action characterized in the report as intended "to inflict maximum damage."
The groups' operations have touched a wide and varied set of targets. The report lists education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail among the sectors affected.
What this means for technologists, procurement leaders, and affected enterprises
- Technologists and security teams: Apply the May 2026 PAN-OS and Prisma Access patches and hunt proactively for indicators of compromise tied to CVE-2026-0257, especially signs of unauthorized gateway-connected sessions and lateral movement into virtualization management appliances.
- Procurement and vendor managers: Re-evaluate patching SLAs and verification processes for critical network gateways and backup products, given attackers’ documented practice of chaining a PAN-OS/Prisma Access bypass to follow-on attacks against Veeam (CVE-2023-27532).
- Affected enterprises and incident responders: Prepare incident response playbooks that assume an adversary can bypass MFA via the gateway, pivot to vCenter/ESXi, and perform offline credential dumping against VMDKs; Palo Alto Networks recommends initiating appropriate incident response protocols when gateway-connected compromises are detected.
Despite a May 2026 patch and placement on the KEV list, the exploitation of CVE-2026-0257 continues to be observed in the wild. The documented move from VPN gateway to the virtualization layer and the use of offline VMDK dumping underline how a single authentication-bypass flaw can be amplified into domain-wide compromise and large-scale ransomware operations. Organizations that operate exposed or unpatched PAN-OS and Prisma Access gateways remain at risk, and the combination of gateway bypass plus targeted attacks on backup infrastructure raises the stakes for timely patching and focused threat hunting.
Original story: https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
