14 mincritical
Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware
Arctic Wolf Labs investigated multiple intrusions during June 2026 where threat actors exploited CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect, to gain initial access and deploy Qilin ransomware. After establishing VPN sessions, attackers performed credential harvesting via LSASS dumping and NTDS extraction, moved laterally using PsExec and administrative shares, deployed multiple remote access tools for persistence, and executed enterprise-wide log clearing before ransomware deployment. The variability in post-exploitation tradecraft across intrusions is consistent with multiple affiliates operating under the Qilin RaaS umbrella sharing exploitation infrastructure.
Sens:■ Immediate
Showing defanged values
- filenamenetscan.exeSoftPerfect Network Scanner deployed by threat actors for network discovery at C:\Windows\Temp\New scan\ and user Desktop locations.
- filenamenxc.exeNetExec (successor to CrackMapExec) used for network enumeration and credential validation across victim environments.
- filenamerclone.exeRclone command-line tool deployed at C:\Windows\Temp\ for exfiltrating stolen data to MEGA cloud storage; flagged by Defender as Behavior:Win32/SuspRclone.A.
- filenamewin.exeQilin ransomware payload consistently named win.exe and staged at C:\PerfLogs\ across all observed intrusions; executed with --password and --no-admin flags via 32-bit cmd.exe.
- ip108[.]61[.]229[.]217External source IP used for CVE-2026-0257 exploitation and subsequent GlobalProtect VPN session from a kali-identified host; appeared in multiple intrusions suggesting shared exploitation infrastructure.
- ip108[.]61[.]75[.]232External source IP used for CVE-2026-0257 exploitation and subsequent GlobalProtect VPN session from a kali-identified host.
- ip199[.]247[.]22[.]193External source IP used for GlobalProtect VPN session from a kali-identified host following CVE-2026-0257 exploitation.
- ip2[.]188[.]33[.]52External source IP used for GlobalProtect VPN session from a kali-identified host following CVE-2026-0257 exploitation.
- ip70[.]34[.]205[.]43External source IP used for GlobalProtect VPN session from a kali-identified host following CVE-2026-0257 exploitation.
Detection / Hunteropenrouter
What Happened
A cybersecurity research team discovered that hackers have been breaking into organizations through a security flaw in Palo Alto Networks firewall VPN systems (CVE-2026-0257). This flaw lets attackers bypass login protections and enter networks without needing passwords. Once inside, the attackers steal account credentials, move between computers, install remote access tools to maintain their connection, and then deploy Qilin ransomware — malicious software that locks up files and demands payment. In some cases, the attackers also stole sensitive data and uploaded it to cloud storage services before locking the files, a tactic called double extortion. Organizations using affected Palo Alto firewall versions should immediately apply the vendor's security patch, review their VPN login records for suspicious activity, and change all passwords if they suspect a breach. They should also monitor the C:\PerfLogs\ folder, which the attackers consistently used to stage their ransomware, and ensure Windows event logs are forwarded to a central location in case the attackers try to erase local evidence.
Key Takeaways
- CVE-2026-0257 (CVSS 7.8) authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portal/gateway was consistently exploited as initial access vector leading to Qilin ransomware deployment across multiple intrusions in June 2026.
- Threat actors used overlapping exploitation infrastructure with source IPs shared across intrusions and VPN sessions originating from hosts self-identifying as 'kali', suggesting shared tooling or coordinated activity.
- Post-exploitation tradecraft varied from rapid encryption-only to full double-extortion with data exfiltration to MEGA cloud storage, consistent with multiple Qilin RaaS affiliates using shared initial access infrastructure.
- Consistent operational patterns observed: ransomware staged at C:\PerfLogs, PsExec-based lateral movement via admin shares, registry Run key persistence with pattern *[a-z]{6}, and enterprise-wide Windows event log clearing via PowerShell.
- Credential harvesting via LSASS dumping (rundll32 + comsvcs.dll) and NTDS extraction (ntdsutil IFM) enabled domain-wide compromise prior to ransomware deployment.
Affected Systems
- PAN-OS 12.1 (before 12.1.4-h6 or 12.1.7)
- PAN-OS 11.2 (before 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 12)
- PAN-OS 11.1 (before 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15)
- PAN-OS 10.2 (before 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6)
- Prisma Access 10.2.0 through 10.2.10-h35, 11.2.0 through 11.2.7-h12
- Windows domain environments (workstations, servers, domain controllers, backup infrastructure)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-0257 | Palo Alto Networks PAN-OS GlobalProtect portal and gateway | High (CVSS 7.8) | Authentication bypass vulnerability exploitable when authentication override cookies are enabled with specific certificate configurations, allowing unauthenticated remote attackers to bypass authentication and establish VPN sessions without valid credentials. |
Attack Chain
- Initial Access: Exploit CVE-2026-0257 authentication bypass in PAN-OS GlobalProtect to establish unauthenticated SSL VPN sessions from kali-identified hosts
- Persistence: Deploy remote access tools (AnyDesk, Ngrok, LogMeIn, MeshAgent) and establish registry Run key persistence with pattern *[a-z]{6} pointing to staged ransomware
- Credential Access: Dump LSASS memory via rundll32+comsvcs.dll and extract NTDS.dit via ntdsutil IFM for domain-wide credential theft
- Discovery & Lateral Movement: Use SoftPerfect Network Scanner and NetExec for network enumeration; move laterally via PsExec through administrative shares (C$) and RDP using compromised credentials
- Exfiltration: Deploy Rclone, ProtonDrive, and FileZilla to exfiltrate data to MEGA cloud storage prior to encryption (in double-extortion intrusions)
- Defense Evasion & Impact: Clear all Windows event logs via PowerShell, disable Defender real-time protection, target Veeam backups, and deploy Qilin ransomware (win.exe) from C:\PerfLogs\ with password-gated execution
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Arctic Wolf Aurora Superintelligence Platform, Public GitHub repository (IOCs appendix)
The article references IOCs and MITRE ATT&CK mappings available in a public GitHub repository appendix, and mentions detections in the Aurora Superintelligence Platform, but does not include specific rule bodies in the blog post itself.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR would capture process execution (rundll32+comsvcs.dll, ntdsutil, PsExec), file creation in C:\PerfLogs, and registry Run key modifications. However, enterprise-wide log clearing and Defender disablement may blind EDR if not centrally forwarded, and some tools like AnyDesk may appear as legitimate software. |
| Network Visibility | Medium | VPN session logs from GlobalProtect would show kali hostnames and source IPs. SMB share access (C$) and Rclone/MEGA traffic are visible at network level, but Ngrok tunneling and legitimate cloud service traffic to MEGA may blend with normal traffic. NetExec and network scanning activity would be visible if network monitoring is in place. |
| Detection Difficulty | Moderate | The attack chain uses many legitimate administrative tools (PsExec, ntdsutil, AnyDesk) that blend with normal activity. However, the consistent staging path C:\PerfLogs, the distinctive registry Run key pattern *[a-z]{6}, LSASS dumping via rundll32+comsvcs.dll, and enterprise-wide log clearing provide several high-signal detection opportunities if telemetry is available. |
Required Log Sources
- Palo Alto GlobalProtect VPN authentication and session logs
- Windows Security Event Logs (Event ID 1102 - audit log cleared, Logon Type 3 events)
- Windows PowerShell Operational logs
- Windows Task Scheduler logs
- Windows Terminal Services logs
- Sysmon Event ID 1 (Process Creation), Event ID 11 (File Creation), Event ID 12/13/14 (Registry changes)
- EDR process telemetry and file creation events
- Network firewall/IDS logs for SMB, RDP, and outbound cloud storage traffic
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Threat actors are staging ransomware payloads in the C:\PerfLogs\ directory, which exists by default but is rarely monitored for executable creation. | File creation events in C:\PerfLogs, specifically executable files; Sysmon Event ID 11 or EDR file creation telemetry. | Impact / Staging | Low — C:\PerfLogs\ is rarely used for legitimate executable placement in standard environments. |
| Threat actors are establishing persistence via registry Run keys with values matching the pattern of an asterisk followed by six lowercase alphabetic characters. | Registry modification events for HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run; Sysmon Event ID 12/13 or EDR registry telemetry. | Persistence | Low — this naming convention is atypical for legitimate software persistence entries. |
| LSASS credential dumping is being performed via rundll32.exe loading comsvcs.dll with MiniDump functionality, writing output to files with non-standard extensions. | Process creation events showing rundll32.exe with comsvcs.dll arguments; file creation events for .odt files in temp directories; Sysmon Event ID 1 and 10 (ProcessAccess targeting lsass.exe). | Credential Access | Low — comsvcs.dll MiniDump usage is rare in legitimate operations. |
| Enterprise-wide Windows event log clearing is being performed via PowerShell using the .NET EventLogSession API to wipe all log channels including peripheral ones. | PowerShell script block logging (Event ID 4104), Windows Security Event ID 1102 (audit log cleared), Sysmon Event ID 3 (network) and process telemetry for powershell.exe. | Defense Evasion | Low — clearing all event log channels is uncommon in normal administrative activity. |
| GlobalProtect VPN sessions are being established from hosts self-identifying with the hostname 'kali' or from hosting provider IP ranges, indicating exploitation of CVE-2026-0257. | Palo Alto GlobalProtect authentication and session logs; VPN gateway logs showing client hostname and source IP information. | Initial Access | Medium — legitimate penetration testers or security engineers may use Kali Linux with VPN, but this should be rare and identifiable. |
Control Gaps
- File-integrity monitoring on C:\PerfLogs\ is typically not configured, allowing ransomware staging to go undetected.
- Local Windows event log clearing removes forensic evidence if logs are not centrally forwarded in real time.
- Legitimate remote access tools (AnyDesk, Ngrok, LogMeIn) may not be blocked or alerted on in environments without explicit allow-listing policies.
- Outbound traffic to MEGA cloud storage infrastructure may not be monitored or alerted on, as it represents legitimate service endpoints.
- PsExec usage via administrative shares may not be alerted on in environments where PsExec is an approved administrative tool.
- Authentication override cookie configurations on GlobalProtect may remain enabled after patching, leaving residual risk.
Key Behavioral Indicators
- Executable file creation in C:\PerfLogs\ directory
- Registry Run key values matching pattern asterisk followed by six lowercase alphabetic characters
- rundll32.exe loading comsvcs.dll with MiniDump arguments targeting LSASS process
- ntdsutil.exe executed with IFM-related arguments (activate instance ntds, ifm, create full)
- PowerShell enumerating and clearing all Windows event log channels via .NET EventLogSession API
- PSEXESVC.exe creation on systems where PsExec is not operationally sanctioned
- Remote file writes to C$\Windows\Temp\ or C$\PerfLogs\ from non-administrative workstations
- Logon Type 3 activity across many systems from a single source in a short time window
- GlobalProtect VPN sessions from hosts with hostname 'kali' or from hosting provider IP ranges
- Rclone execution from C:\Windows\Temp\ with outbound connections to MEGA storage infrastructure
- Windows Security Event ID 1102 (audit log cleared) occurring across multiple systems
False Positive Assessment
Medium — Several tools used in this attack chain (PsExec, ntdsutil, AnyDesk, Rclone, FileZilla) are legitimate administrative or productivity tools that may be used in normal operations. Detection based on individual tool usage would generate false positives; however, the combination of staging in C:\PerfLogs, the distinctive registry Run key pattern, LSASS dumping via comsvcs.dll, enterprise-wide log clearing, and VPN sessions from kali-identified hosts provides high-signal indicators with low false positive rates when correlated.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. If you run affected PAN-OS versions, consider applying the vendor patch for CVE-2026-0257 immediately on all internet-facing Palo Alto Networks firewall appliances and terminating all active GlobalProtect sessions to invalidate unauthorized access.
- If exploitation of CVE-2026-0257 is suspected or confirmed, consider rotating all domain administrative account passwords, the KRBTGT account password (twice, per Microsoft guidance), service account passwords, and any credentials for cloud storage services that may have been compromised.
- Consider reviewing GlobalProtect VPN authentication logs for sessions originating from hosting provider IP ranges, sessions with client hostnames of 'kali' or Windows-default format (DESKTOP-[ALPHANUMERIC]), and sessions from unexpected geographic locations or network providers.
- If your EDR supports host isolation, consider isolating systems showing signs of compromise (ransomware staging in C:\PerfLogs, LSASS dumping activity, or PsExec-based lateral movement) to prevent further spread.
- Consider disabling authentication override options on GlobalProtect or using dedicated certificates for authentication override cookies as a mitigation if patching cannot be immediately performed.
Infrastructure Hardening
- Consider implementing file-integrity monitoring on C:\PerfLogs\ for any executable file creation and application control policies that block execution from this directory.
- Evaluate whether blocking or alerting on AnyDesk, Ngrok, and LogMeIn traffic from systems where these tools are not business-sanctioned would reduce remote access tool abuse risk.
- Consider implementing network-level controls to alert on high-volume outbound transfers to MEGA storage infrastructure, especially from domain controllers, file servers, or systems that do not typically interact with cloud storage services.
- If supported by your logging infrastructure, consider forwarding Windows Event Logs to a centralized SIEM in real time to preserve forensic evidence even if local logs are cleared by threat actors.
- Consider implementing alerting on Windows Security Event ID 1102 (audit log cleared) and treat occurrences across multiple systems as a potential indicator of adversary presence.
- Evaluate whether restricting NTDS.dit access and alerting on ntdsutil.exe execution with IFM-related arguments would improve detection of domain credential theft.
User Protection
- Consider deploying endpoint detection that alerts on rundll32.exe loading comsvcs.dll with MiniDump arguments, as this is a known LSASS credential dumping technique.
- If your EDR supports it, consider enabling alerting for processes spawned from C:\PerfLogs\ and for PSEXESVC.exe creation on systems where PsExec is not operationally approved.
- Consider evaluating whether Microsoft Defender real-time protection disablement events are alerted on, as threat actors disabled Defender prior to ransomware deployment in some intrusions.
- Consider implementing alerting on remote file writes to C$\Windows\Temp\ or C$\PerfLogs\ from non-administrative workstations to detect lateral movement staging.
Security Awareness
- Consider incorporating awareness of VPN session anomalies (unexpected hostnames, hosting provider IPs, unusual geographic locations) into existing security monitoring training for SOC analysts.
- If applicable to your organization, consider reminding IT staff that C:\PerfLogs\ is a default Windows directory that is rarely monitored and should be treated as a sensitive location for executable file creation.
- Consider reviewing existing policies around remote access tool usage (AnyDesk, LogMeIn, Ngrok) and communicating approved tool lists to employees if such policies exist.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping16 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Registry Keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*[a-z]{6}- Registry Run key persistence value following pattern asterisk followed by six randomized lowercase alphabetic characters; observed across multiple intrusions as a possible Qilin-builder configuration artifact pointing to staged ransomware payload.
- File Paths:
C:\PerfLogs\win.exe- Primary staging location for Qilin ransomware payload; C:\PerfLogs\ exists by default, is rarely monitored, and is writable without elevated privileges in many configurations.C:\PerfLogs\AnyDesk.exe- AnyDesk remote access tool deployed to PerfLogs staging directory for persistent access.C:\Windows\Temp\AnyDesk.exe- AnyDesk remote access tool deployed to Windows Temp directory.C:\ProgramData\AnyDesk\AnyDesk.exe- AnyDesk remote access tool deployed to ProgramData directory.C:\Program Files (x86)\AnyDesk\AnyDesk.exe- AnyDesk remote access tool deployed to Program Files (x86) directory; multiple paths suggest repeated deployment or evasion of path-based detections.C:\Windows\Temp\NTDS\- Output directory for NTDS.dit extraction via ntdsutil IFM method, containing full Active Directory database copy with all domain account password hashes.C:\audit\Active Directory\ntds.dit- Alternate location where NTDS extraction artifacts were observed.C:\Windows\Temp\New scan\netscan.exe- SoftPerfect Network Scanner deployed for network discovery and identifying accessible systems.C:\Windows\Temp\rclone.exe- Rclone tool deployed for automated data exfiltration to MEGA cloud storage.C:\Windows\Temp\output.odt- LSASS memory dump output file with .odt extension to evade file-type-based monitoring rules that alert on .dmp extensions.
- Command Lines:
- Purpose: LSASS memory dump for credential harvesting | Tools:
rundll32.exe,comsvcs.dll| Stage: Credential Access |rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> <output_path> full - Purpose: NTDS.dit extraction via Install From Media (IFM) for domain-wide credential theft | Tools:
ntdsutil.exe| Stage: Credential Access |ntdsutil.exe "activate instance ntds" "ifm" "create full <path>" quit quit - Purpose: Qilin ransomware execution with password gate and no-admin flag | Tools:
win.exe,cmd.exe| Stage: Impact |C:\PerfLogs\win.exe --password <redacted> --no-admin - Purpose: Enterprise-wide Windows event log clearing via .NET EventLogSession API | Tools:
powershell.exe| Stage: Defense Evasion
- Purpose: LSASS memory dump for credential harvesting | Tools:
- Other:
\MeshUserTask- Scheduled task name associated with MeshAgent deployment for persistent remote access in one observed intrusion.
