Cybersecurity
Qilin and INC exploit Palo Alto flaw
Palo Alto Networks said it had continued to see ransomware actors using a patched authentication-bypass flaw in PAN-OS and Prisma Access to gain access, bypass MFA and move through networks.
- Palo Alto Networks said it had continued to see exploitation of CVE-2026-0257 in PAN-OS and Prisma Access after patching it in May 2026.
- The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on 13 May 2026.
- Unit 42 said Spikey Scorpius, also called Qilin, and Tarnished Scorpius, also called INC, were among the ransomware operators using the flaw.
- Palo Alto Networks said organisations should hunt for indicators of compromise and start incident response if gateway-connected events were detected.
Palo Alto Networks said it was still seeing exploitation of CVE-2026-0257 in PAN-OS and Prisma Access after fixing it in May 2026. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities list on 13 May 2026.
Unit 42 said ransomware operators including Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as INC, had used the bug. The researchers said the access was used to enter corporate networks and then bypass multi-factor authentication to establish VPN sessions.
After that, the attackers were said to have carried out internal reconnaissance with remote monitoring tools, moved through RDP and SMB, and prepared tools for credential theft, data removal and ransomware deployment. Unit 42 said the activity had been seen across sectors including education, finance, healthcare, government, transport, utilities and retail.
The researchers said the most notable change was a move into the virtualisation layer. In one case, they said, attackers moved from the VPN gateway to vCenter, disabled ESXi protections and used a custom tool against a domain controller's virtual disk; Palo Alto Networks said the method could bypass in-guest security controls.
Palo Alto Networks said attackers had also tried to combine the access with other exploit tools, including attempts against Veeam backup infrastructure. It said organisations should search for compromise indicators and begin incident response if gateway-linked events were found.
Named in this story
Companies
- Palo Alto Networks
- disclosed continued exploitation and advised incident hunting
- ReliaQuest
- said it detected Qilin and Settra exploiting the flaw
- Arctic Wolf
- previously flagged Qilin's exploitation of the flaw
- Veeam
- backup infrastructure attackers also tried to target
Organisations
- Unit 42
- issued the update describing the attack activity
- Spikey Scorpius (aka Qilin)
- ransomware group named as exploiting the flaw
- Tarnished Scorpius (aka INC)
- ransomware group named as exploiting the flaw
- Settra
- ransomware group ReliaQuest said was exploiting the flaw
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaw to its Known Exploited Vulnerabilities catalog
Products and systems
- PAN-OS
- affected software platform
- Prisma Access
- affected cloud security service
- vCenter management appliance
- system attackers pivoted to after initial access
- ESXi hypervisors
- virtualisation systems whose protections attackers disabled
How the source tells it
The piece was mostly a straightforward technical update, but it used a cautious, urgent register when describing attacker tactics and urging immediate hunting for compromise.
- urgency Recent-timing references and direct advice to act immediately created time pressure
- alarm Superlative wording and worst-case damage descriptions elevated the perceived severity