Palo Alto Networks has revealed that ransomware operators are continuing to weaponize a patched security vulnerability in its PAN-OS and Prisma Access products, despite fixes released seven months ago. Unit 42 researchers disclosed Monday that two ransomware groups—Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also called INC)—are actively exploiting CVE-2026-0257, an authentication bypass weakness that lets attackers establish unauthorized VPN connections. The flaw, which carries a severity score of 7.8, was fixed by Palo Alto Networks in May 2026 and added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on May 13, 2026.
The threat actors are using the vulnerability to gain initial access to corporate networks, then circumventing multi-factor authentication controls to create VPN sessions, according to the report. Once inside, attackers perform internal network reconnaissance with dual-use remote monitoring and management tools, move laterally through the network using RDP and SMB protocols, and deploy additional tools for credential theft, data exfiltration, and ransomware installation. Campaigns have hit a broad spectrum of industries, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. The disclosure follows a report from ReliaQuest days earlier that identified both Qilin and Settra ransomware groups exploiting the same flaw in financially motivated attacks.
Unit 42 researchers highlighted a significant shift in attacker behavior following successful exploitation. "The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer," the report states. In one case, attackers moved from the breached VPN gateway to the vCenter management appliance, then disabled security controls on ESXi hypervisors and used a custom tool to dump credentials offline directly from a domain controller's virtual disk. Arctic Wolf had previously flagged Qilin's exploitation of CVE-2026-0257 in July 2026, with attacks ranging from quick encryption-only operations to full double-extortion schemes.
This virtualization-focused approach allows threat actors to sidestep in-guest endpoint detection and response systems and security protections, according to Palo Alto Networks, enabling them to obtain domain-wide credentials without triggering traditional defenses. The network security vendor noted that attackers have also been chaining the initial access method with other exploit tools, including attempts to target Veeam backup infrastructure by abusing known vulnerabilities (CVE-2023-27532) to inflict maximum damage. This tactic of attacking backup systems ensures that victims cannot easily recover encrypted data, increasing pressure to pay ransoms.
Palo Alto Networks is urging organizations to apply the latest patches immediately and recommending that companies proactively hunt for indicators of compromise in their environments. If organizations detect successful gateway-connected events, they should initiate appropriate incident response protocols without delay. The continuing exploitation seven months after patches became available highlights a persistent challenge: attackers routinely target known vulnerabilities in widely deployed enterprise security infrastructure, betting that many organizations haven't yet updated their systems. Defenders who treat patching as an optional maintenance task rather than an urgent security imperative may find themselves facing a choice between paying ransoms or losing critical business data.