Palo Alto Networks has warned that ransomware groups continue to exploit CVE-2026-0257, a security flaw affecting PAN-OS and Prisma Access that allows attackers to establish unauthorized VPN connections. The vulnerability was patched in May 2026.
According to Palo Alto Networks’ Unit 42 researchers, the ransomware groups Qilin (aka Spikey Scorpius) and INC (Tarnished Scorpius) are using the flaw to gain initial access to corporate networks and bypass multi-factor authentication (MFA).
After establishing VPN sessions, attackers use remote monitoring and management (RMM) tools to explore internal networks, move between systems through Remote Desktop Protocol (RDP) and Server Message Block (SMB), and deploy tools for credential theft, data exfiltration, and ransomware attacks.
The campaigns have targeted multiple sectors, including healthcare, finance, education, government, manufacturing, retail, and energy. Researchers have also observed attackers targeting Veeam backup infrastructure by exploiting the CVE-2023-27532 vulnerability.
In one case, attackers moved from a compromised VPN gateway to a VMware vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors, and used a custom tool to extract credentials offline from a domain controller’s virtual disk (VMDK).