Palo Alto Networks' **Unit 42** research team has disclosed continued active exploitation of a critical security flaw, **CVE-2026-0257**, affecting its **PAN-OS** and **Prisma Access** platforms. Despite being patched in May 2026 and added to the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)**'s Known Exploited Vulnerabilities (KEV) catalog, the vulnerability remains a significant threat. ### The Authentication Bypass Vulnerability **CVE-2026-0257** (CVSS score: 7.8) is an authentication bypass flaw that allows threat actors to establish unauthorized VPN connections. This initial access enables attackers to circumvent multi-factor authentication (MFA) controls, a cornerstone of modern cybersecurity defenses. ### Notorious Ransomware Groups in Action **Unit 42** researchers specifically identified **Spikey Scorpius**, also known as **Qilin**, and **Tarnished Scorpius**, also known as **INC**, as the ransomware operators actively weaponizing this vulnerability. This aligns with earlier findings by **ReliaQuest**, which also observed **Qilin** and **Settra** ransomware groups exploiting the flaw in financially motivated attacks. ### Post-Compromise Activities Once a VPN session is established, the attackers engage in a range of sophisticated post-compromise activities, including: * **Internal Network Reconnaissance**: Utilizing dual-use remote monitoring and management (RMM) tools. * **Lateral Movement**: Expanding their foothold across the network via **RDP** and **SMB**. * **Tool Staging**: Preparing additional tools for credential harvesting, data exfiltration, and the ultimate deployment of ransomware. ### Targeting the Virtualization Layer A critical evolution in the attackers' tactics, techniques, and procedures (TTPs) is their direct pivot to the virtualization layer. **Unit 42** highlighted a case where attackers moved from a compromised VPN gateway to the **vCenter** management appliance. From there, they disabled security controls on **ESXi** hypervisors (`execInstalledOnly`) and deployed a custom tool to perform offline credential dumping directly from a domain controller's virtual disk (**VMDK**). This method effectively bypasses in-guest endpoint detection and response (EDR) and other security protections, granting the threat actors domain-wide credentials. ### Chaining Exploits for Maximum Impact Attackers have also been observed chaining this initial access method with other exploit tools. Notably, they have targeted **Veeam** backup infrastructure by abusing known flaws, such as **CVE-2023-27532**, to inflict maximum damage and ensure data recovery is severely hampered. ### Widespread Sector Impact The attacks mounted by these groups have impacted a broad spectrum of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. ### Recommendations for Defense Palo Alto Networks strongly recommends that organizations not only apply the latest fixes for **CVE-2026-0257** but also proactively hunt for indicators of compromise. Furthermore, initiating appropriate incident response protocols is crucial if successful gateway-connected events are detected, especially given the sophisticated nature of these attacks and their focus on bypassing core security controls.