Qilin ransomware crew is breaking into Palo Alto VPNs through an unpatched flaw

Key points

• Arctic Wolf Labs said on Monday that Qilin ransomware affiliates are exploiting a critical Palo Alto Networks flaw, CVE-2026-0257, to break into corporate networks.
• Palo Alto Networks patched the GlobalProtect authentication bypass on May 13, 2026, after Rapid7 spotted active exploitation from May 17.
• CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 29 and gave federal agencies three days to fix it.
• Shadowserver counts more than 167,000 GlobalProtect VPN instances still reachable from the public internet.
• Qilin has named over 2,000 victims on its dark web leak site since surfacing in August 2022, including Nissan, Yangfeng, Synnovis and Lee Enterprises.

A Russian-speaking ransomware crew called Qilin is breaking into company networks by abusing a serious flaw in Palo Alto Networks firewalls, according to cybersecurity firm Arctic Wolf.

Qilin runs what the industry calls ransomware-as-a-service: the core gang builds the file-locking malware and rents it out to other criminals, called affiliates, who do the actual break-ins and split the profits. The group first appeared in August 2022 under the name Agenda. Its leak site now lists more than 2,000 victims, among them carmaker Nissan, parts supplier Yangfeng, UK pathology firm Synnovis and publisher Lee Enterprises.

The flaw is tracked as CVE-2026-0257. It sits in GlobalProtect, the remote-access VPN that Palo Alto Networks customers use to let staff log in from outside the office. The bug lets an attacker skip the login check entirely and establish an unauthorised VPN connection into the corporate network, as if they were an employee. We first reported the vulnerability on 30 May 2026, in "Palo Alto GlobalProtect Auth Bypass Hits Live Exploitation".

Palo Alto Networks issued a fix on May 13, 2026, saying it had seen "limited exploit attempts on unpatched PAN-OS devices". Rapid7 then reported exploitation across numerous customers from May 17. CISA added the bug to its Known Exploited Vulnerabilities catalog on May 29 and ordered federal agencies to patch within three days.

How are the criminals getting in?

They're hitting the firewall directly over the internet. Because the flaw bypasses the login screen on GlobalProtect, an attacker only needs to find an unpatched device and send a crafted request, then establish a VPN tunnel and move inside the network.

Arctic Wolf, first reported by BleepingComputer, investigated several separate intrusions in June 2026 that all started with CVE-2026-0257 exploitation and ended with Qilin ransomware encrypting entire Windows domains. Some attackers went straight to encryption; others stole data first and threatened to publish it, the tactic known as double extortion. That split suggests different affiliates running their own playbooks under the Qilin banner.

The exposure is large. Shadowserver tracks more than 167,000 GlobalProtect instances reachable online; Shodan, a similar scanning service, sees over 172,000. Some will be patched, some will be honeypots set up to lure attackers, but the raw numbers show how much attack surface is out there. Palo Alto Networks says its products are used by more than 70,000 customers, including most large U.S. Banks and 90% of the Fortune 10.

Arctic Wolf's own assessment is blunt: the attacks are "likely ongoing" and scanning for vulnerable devices continues, driven by the RaaS model's tendency to spread a working exploit across many affiliates fast.

Should you worry?

If your bank or hospital goes quiet, cancels appointments, or asks you to reset passwords in the coming weeks, this is the kind of intrusion that sits behind it. Watch for breach notification emails from services you use. Criminals routinely follow ransomware attacks with fraud attempts aimed at customers, so treat unexpected calls or messages claiming to be from an affected company with real scepticism.