A Familiar Entry Point With a New Twist

Security researchers at Arctic Wolf Labs have tied a wave of June 2026 ransomware intrusions to a single root cause: a critical authentication bypass in Palo Alto Networks’ PAN-OS software. The flaw, catalogued as CVE-2026-0257 and carrying a CVSS score of 7.8, lives in the GlobalProtect VPN portal and gateway. When authentication override cookies are combined with certain certificate settings, an attacker with no credentials at all can slip past login controls and open what looks like a completely legitimate VPN session.

That’s a dangerous shortcut. Instead of phishing employees or brute-forcing passwords, intruders walk straight through the front door and land inside the corporate network with interactive access. Palo Alto Networks has confirmed the bug is being exploited in the wild, and the affected footprint is broad: PAN-OS 10.2, 11.1, 11.2, and 12.1 builds released before the patch, along with specific Prisma Access configurations.

From Firewall Bypass to Full Domain Compromise

Once inside, the attackers Arctic Wolf tracked moved with practiced efficiency. They planted persistence through Windows registry Run keys named with an asterisk followed by six random lowercase letters, then layered in remote-access software such as AnyDesk, Ngrok, and LogMeIn to guarantee they wouldn’t lose their foothold if one channel was cut.

Credential theft came next. The intruders dumped LSASS memory using rundll32.exe paired with comsvcs.dll, renaming the output to mimic an innocuous “.odt” file so it would blend into normal traffic. From there they pulled the entire Active Directory database via ntdsutil.exe, handing themselves domain-wide credentials, and used PsExec along with administrative shares to move laterally across the environment.

Several of the intrusions Arctic Wolf reviewed originated from machines self-reporting the hostname “kali,” and overlapping IP infrastructure turned up across both the initial exploitation and later VPN logins — a pattern suggesting affiliates are drawing from a shared toolkit rather than improvising independently.

A Ransomware-as-a-Service Playbook

The variation researchers observed after initial access is a hallmark of ransomware-as-a-service operations, where a central group distributes exploits and tooling to affiliates who then run their own version of the attack. Some intrusions jumped almost immediately to file encryption; others spent time on reconnaissance, mass credential harvesting, and quietly siphoning data out to MEGA cloud storage using Rclone before the ransomware ever executed.

Regardless of pace, nearly every intrusion followed the same pre-encryption ritual: disable Microsoft Defender’s real-time protection, then wipe every Windows Event Log channel with a PowerShell script — not just the security or system logs, but all of them, making after-the-fact forensic reconstruction significantly harder. The ransomware binary itself was consistently named win.exe and staged inside C:\PerfLogs\, a legitimate Windows directory that most security tools rarely watch. Execution required a password argument, a small but effective hurdle against automated sandbox analysis.

What Defenders Should Do Now

Arctic Wolf says it holds moderate confidence that active exploitation of CVE-2026-0257 to deploy Qilin ransomware is ongoing, fueled by widespread internet scanning and the tendency of RaaS affiliates to reuse working exploits once one group proves them out. Organizations running exposed GlobalProtect portals or gateways should treat this as an urgent patching priority. Recommended steps include:

• Apply the PAN-OS and Prisma Access patches addressing CVE-2026-0257 across every internet-facing deployment
• Terminate all active GlobalProtect sessions immediately after patching, since existing sessions may already be compromised
• Rotate all domain credentials, including the KRBTGT account, if exploitation is suspected
• Restrict or closely monitor execution from C:\PerfLogs, an unusual but now-abused staging ground
• Forward Windows Event Logs to a centralized SIEM so evidence survives even if local logs are wiped

The incident is a reminder that perimeter authentication bypasses remain one of the most efficient ways for ransomware crews to skip straight past an organization’s outer defenses — and that patching internet-facing VPN infrastructure promptly is still one of the highest-leverage security investments available.