Qilin Ransomware Exploits Palo Alto Security Flaw

What Happened

The cybersecurity world is on high alert following a new wave of attacks orchestrated by the Qilin (also known as Agenda) ransomware group. Threat actors have been discovered using a now-patched, high-severity vulnerability in the PAN-OS software from network security giant Palo Alto Networks as their initial entry point into victim networks. Analysis by cybersecurity researchers at Arctic Wolf Labs revealed that this method was behind numerous cyberattacks in June 2026. The attackers exploit this vulnerability to infiltrate corporate networks, subsequently deploying ransomware to either encrypt data or employ a double extortion tactic by both stealing and encrypting data.

The central vulnerability in these attacks is identified as CVE-2026-0257, which has been rated with a high CVSS (Common Vulnerability Scoring System) score of 7.8. This flaw is essentially an authentication bypass vulnerability affecting the portal and gateway components of the PAN-OS software. By leveraging this flaw, attackers can initiate VPN sessions without credentials, thus gaining unauthorized access to the network. This particularly targets systems where authentication override cookies are enabled with specific certificate configurations. Once inside the network, the attackers employ varied methods to escalate their attacks. The diversity in these attacks suggests that Qilin operates under a Ransomware-as-a-Service (RaaS) model, involving multiple affiliated groups with different skill sets conducting these operations. Such models allow ransomware developers to lease their tools to other cybercriminals, increasing the scale and variety of attacks. These developments are a significant topic in the latest Data Breach News.

What Data Was Leaked

In the cases investigated by Arctic Wolf, affiliates of the Qilin group were observed adopting the double extortion model. In this model, attackers not only encrypt the data on the victim's systems but also exfiltrate large volumes of sensitive data to their own controlled servers before encryption. According to the source report, tools such as Rclone, Proton Drive, and FileZilla were used for data exfiltration operations. The data was reportedly transferred to the popular cloud storage service, MEGA. This method creates an additional layer of pressure on the victim. If the ransom is not paid, the attackers threaten not only to keep the systems locked but also to leak the stolen data to the public or sell it to other criminals on the dark web.

Although the source article does not provide specific details about the nature of the stolen data, such attacks typically target critical corporate information, including customer data, financial records, employee personal information, trade secrets, and intellectual property. In cases where data exfiltration occurs, companies face not only operational downtime and ransom costs but also long-term consequences such as legal penalties, reputational damage, and loss of customer trust. It is also noted that in some instances, attackers skipped the data exfiltration phase and focused on rapidly encrypting the entire corporate network. This variation may depend on the strategy of the affiliate group conducting the attack or the architecture of the victim's network.

How Did the Attack Happen

The attackers' playbook includes both consistent steps and variable tactics. Each stage of the attack chain consists of carefully planned actions.

1. Initial Access: Exploiting CVE-2026-0257

It all begins with the exploitation of the CVE-2026-0257 authentication bypass vulnerability in Palo Alto Networks' PAN-OS software. Attackers use this flaw to bypass the target network's firewall and initiate an SSL VPN session without a valid username or password. This grants them a secure foothold inside the network, allowing them to act like an internal user. This first step is the most critical phase of the attack as it establishes a bridge from the outside world into the internal network.

2. Privilege Escalation and Reconnaissance

Once inside the network, the attackers' next objective is to escalate their privileges. Typically starting with low-level access, they move through the network to harvest credentials for administrator accounts. These credentials are the key to accessing all other systems on the network. At this stage, some affiliated groups were observed conducting extensive reconnaissance activities using legitimate remote access tools like AnyDesk, Ngrok, or LogMeIn. These tools are often used by IT administrators, making them harder to detect by security systems.

3. Lateral Movement: Spreading with PsExec

With the compromised administrator credentials, the attackers proceed to the lateral movement phase. This involves moving from one computer to another within the network to gain access to as many systems as possible for ransomware deployment. The Qilin attackers were consistently found to be using the PsExec tool for this stage. PsExec is a legitimate tool, part of Microsoft's Sysinternals suite, that allows administrators to execute commands on remote systems. The attackers leverage this tool over Windows administrative shares to infiltrate other computers on the network and execute their commands.

4. Defense Evasion and Preparation

Before executing the ransomware, the attackers take several steps to minimize the risk of detection. The first is to disable antivirus and security software, such as Microsoft Defender Real-Time Protection. The second, and perhaps most crucial, step is to comprehensively clear event logs to avoid leaving forensic evidence. This makes the post-incident investigation for security teams significantly more difficult.

5. Ransomware Deployment and Encryption

After all preparations are complete, the ransomware is deployed. The attackers were observed staging the ransomware payload in the C:\PerfLogs\ directory. This directory is a legitimate Windows folder for performance logs, so it can often be overlooked. Another notable detail is that the deployed ransomware payloads were password-protected. This is a technique used to make it harder for security products to detect the malware through static analysis. In the final stage, the ransomware is executed, and all accessible file systems are encrypted.

Who Is Affected

The report published by Arctic Wolf Labs states that they responded to incidents at multiple organizations affected by this attack method in June 2026. However, no details about the victims' identities, their industries, or geographic locations were publicly disclosed. The fact that the vulnerability affects the widely used PAN-OS software from Palo Alto Networks means that thousands of companies worldwide using these products are potentially at risk. It is believed that the attackers act opportunistically, scanning the internet for systems that are exposed and vulnerable, rather than targeting a specific sector. Therefore, all public and private sector organizations using the affected versions of PAN-OS are potential targets.

What You Can Do

Taking proactive steps to protect your organization from the Qilin ransomware and similar threats is of vital importance. Here are the steps you should take:

• Patch Immediately: If you use Palo Alto Networks PAN-OS, ensure you have applied the updates that address the CVE-2026-0257 vulnerability without delay. Keeping your software and devices up to date is the most effective way to prevent attacks that exploit known vulnerabilities.
• Review Configurations: As noted in the report, the exploitation of the vulnerability requires specific configurations to be enabled (authentication override cookies). Assess whether you truly need such configurations and disable any unnecessary features.
• Monitor for Indicators of Compromise (IOCs): Your security teams should search for the IOCs mentioned in the report within your network. These include the presence of suspicious files in the C:\PerfLogs\ directory, unexpected use of PsExec, the clearing of event logs, and the unusual Windows Registry persistence pattern described as "an asterisk followed by six randomized lowercase alphabetic characters."
• Implement Network Segmentation: Restrict an attacker's ability to move laterally by segmenting your network into smaller zones. This makes it harder for an attack to spread across the entire network even if one system is compromised.
• Use Strong Authentication: Enforce multi-factor authentication (MFA), especially for VPN and remote access solutions. This helps prevent unauthorized access even if credentials are stolen.

What the Company Is Saying

The cybersecurity firm Arctic Wolf Labs, which conducted the attack analysis, announced its findings in a public report. The company stated that Qilin ransomware operators are actively exploiting the PAN-OS vulnerability and that the observed variety in post-exploitation tactics points to a RaaS (Ransomware-as-a-Service) operation involving multiple affiliates. "Attackers demonstrated consistent operational patterns despite tradecraft variation: staging ransomware at C:\PerfLogs\, using PsExec for lateral execution via administrative shares, deploying password-protected ransomware payloads, and implementing comprehensive log-clearing routines," Arctic Wolf stated.

Palo Alto Networks, the owner of the affected product, had previously released security updates to address the CVE-2026-0257 vulnerability. The company continuously urges all its customers to protect themselves against this and other potential threats by updating their systems to the latest version.

Source

https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html