Full Report
Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway
Analysis Summary
# Incident Report: Qilin Ransomware Exploitation of PAN-OS Vulnerability
## Executive Summary
Threat actors associated with the Qilin (aka Agenda) ransomware-as-a-service (RaaS) group exploited a high-severity authentication bypass vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0257) to gain initial access to corporate networks. Arctic Wolf Labs observed multiple intrusions in June 2026 resulting in varying impacts, ranging from immediate encryption to full double-extortion data theft. Following the breach of the VPN perimeter, attackers moved laterally using administrative shares and PsExec before deploying password-protected ransomware payloads.
## Incident Details
- **Discovery Date:** June 2026
- **Incident Date:** June 2026
- **Affected Organization:** Multiple undisclosed organizations
- **Sector:** Diversified (consistent with RaaS targeting)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026
- **Vector:** Exploitation of CVE-2026-0257
- **Details:** Attackers exploited an authentication bypass flaw in the PAN-OS portal and gateway components. This allowed them to establish SSL VPN sessions without valid credentials by bypassing authentication override cookies.
### Lateral Movement
- **Mechanism:** Attackers leveraged compromised administrative accounts to move through the network.
- **Tools:** Utilization of Windows administrative shares and **PsExec** for remote execution across the environment.
### Data Exfiltration/Impact
- **Data Theft:** In some instances, large-scale credential theft and data exfiltration occurred.
- **Destination:** Data was moved to the **MEGA** cloud service.
- **Encryption:** Password-protected ransomware was staged at `C:\PerfLogs\` and deployed enterprise-wide.
### Detection & Response
- **Discovery:** Investigations conducted by Arctic Wolf Labs following multiple intrusions.
- **Response Actions:** Forensics revealed log-clearing routines and the disabling of security software intended to mask the attack.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2026-0257 (PAN-OS Auth Bypass).
- **Persistence:** Implementation of a Windows Registry persistence pattern using an asterisk followed by six randomized lowercase alphabetic characters.
- **Privilege Escalation:** Compromise of administrative accounts following initial VPN access.
- **Defense Evasion:** Disabling of Microsoft Defender Real-Time Protection and execution of comprehensive event log-clearing routines.
- **Credential Access:** Large-scale credential harvesting (varying by affiliate).
- **Discovery:** Extensive reconnaissance using tools like **AnyDesk**, **Ngrok**, or **LogMeIn**.
- **Lateral Movement:** Execution via administrative shares using **PsExec**.
- **Collection:** Gathering data for potential exfiltration; use of **Rclone**, **Proton Drive**, and **FileZilla**.
- **Exfiltration:** Transfer of data to **mega[.]nz**.
- **Impact:** Encryption of files using Qilin ransomware; double-extortion tactics.
## Impact Assessment
- **Financial:** High (Ransomware recovery costs and potential extortion payments).
- **Data Breach:** Confirmed exfiltration of sensitive corporate data in multiple intrusions.
- **Operational:** Significant disruption due to enterprise-wide encryption of systems.
- **Reputational:** Variable based on the publication of data on Qilin’s leak site.
## Indicators of Compromise
- **Network Indicators:**
- SSL VPN sessions established from unauthorized/unusual IP addresses.
- Exfiltration traffic to `mega[.]nz`.
- **File Indicators:**
- Ransomware staged at: `C:\PerfLogs\`
- Use of **rclone.exe**, **psexec.exe**, and remote access tools (**AnyDesk**, **LogMeIn**).
- **Behavioral Indicators:**
- Registry Key: `*XXXXXX` (where X is a random lowercase letter) for persistence.
- Massive clearing of Windows Event Logs.
- Sudden disabling of Microsoft Defender Real-Time Protection.
## Response Actions
- **Containment:** Disabling compromised VPN sessions and resetting administrative account credentials.
- **Eradication:** Removal of persistence registry keys and deletion of staged ransomware binaries in `C:\PerfLogs\`.
- **Recovery:** Restoration of systems from backups (where available and non-encrypted).
## Lessons Learned
- **Patch Management:** High-severity vulnerabilities in perimeter devices (VPNs/Firewalls) are prioritized by RaaS affiliates for rapid weaponization.
- **MFA Limitations:** Authentication bypass vulnerabilities can render Multi-Factor Authentication (MFA) ineffective if the flaw exists at the protocol or session handling level.
- **Affiliate Diversity:** The variation in post-exploitation tradecraft highlights that different groups (affiliates) use the same entry point but different toolsets.
## Recommendations
- **Immediate Patching:** Ensure PAN-OS is updated to the latest version to remediate CVE-2026-0257.
- **Hardening:** Disable "authentication override" features in PAN-OS if not strictly required by the business configuration.
- **Monitoring:** Implement alerting for the clearing of Windows Security Logs and the disabling of Microsoft Defender.
- **Restricted Execution:** Limit the use of PsExec and similar administrative tools to authorized jump hosts only.