Qilin and INC use the GlobalProtect auth bypass to skip MFA, then dump domain controller disks

Unit 42 at Palo Alto Networks updated its threat brief on CVE-2026-0257 on October 19 to name two ransomware operators exploiting it: Spikey Scorpius (Qilin) and Tarnished Scorpius (INC), with public reporting also tying Settra ransomware to the flaw. CVE-2026-0257 (CVSS 7.8) is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS and Prisma Access that lets an attacker start a VPN connection without valid credentials; Palo Alto patched it in May, and CISA added it to its KEV catalog on May 13. Unit 42 says attackers used it to get past MFA, then ran RMM tools, moved over RDP and SMB, and staged credential theft and ransomware. In one case they went from the VPN gateway to vCenter, disabled ESXi security controls, and dumped credentials offline from a domain controller's virtual disk.

Why it matters

The VPN gateway is where MFA is enforced for remote access, so a bypass there removes the second factor for every account behind it. The vCenter step matters as much: copying a domain controller's disk reads the whole Active Directory database without touching the guest, so EDR on the DC never sees it. Whoever controls the hypervisor controls the directory.

Patch or apply the advisory workarounds, then hunt: Unit 42 lists nine IP addresses and suspicious host IDs to search for in GlobalProtect logs, and any successful gateway connection from them is an incident. Check whether GlobalProtect is exposed on management-interface ports 4443 or 3879. Treat vCenter and ESXi admin accounts as tier-zero identities, with phishing-resistant MFA and sign-in that does not depend on the Active Directory they host. Our July post on Qilin's first use of this flaw has the earlier tradecraft.

Source: Unit 42