#Ransomware — insecure by design

critical2 sourcesCVE-2026-0257

Ransomware Crews Exploit Unpatched Palo Alto GlobalProtect Auth Bypass to Blend With Legitimate Remote Traffic

Threat actors associated with the Qilin and Settra ransomware operations are actively exploiting CVE-2026-0257 to bypass authentication on Palo Alto Networks PAN-OS GlobalProtect and Prisma Access appliances. Disclosed back in May 2026, the vulnerability carries an initial CVSS score of 7.8 from the vendor alongside a critical 9.1 rating assigned by the National Vulnerability Database. The flaw specifically compromises the GlobalProtect portal and gateway subsystems, giving external adversaries an avenue to initiate fully authenticated VPN tunnels without going through proper credentials validation. Exposure relies heavily on particular device configurations, specifically requiring the activation of authentication override cookies in tandem with a distinct certificate setup. Deployments managed via Panorama or running on Cloud NGFW remain entirely unaffected by this flaw. Once authenticated through the edge gateway, attackers appear in connection logs virtually indistinguishable from regular remote employees, masking their reconnaissance until malicious tooling appears downstream. Post-exploitation activities linked to these intrusions feature common enterprise assessment and movement tools, namely Cobalt Strike, BloodHound, and SharpHound. Investigators have flagged anomalous connection metadata, notably connecting sessions advertising the default OS hostname "kali", as initial leads during telemetry analysis. Security researchers track multiple operational IP addresses leveraged during these sweeps, including `216.245.184.150`, `216.245.184.47`, `216.245.184.110`, and `216.245.184.0`. While CISA previously mandated US federal agency remediation by June 1 after listing the bug on its Known Exploited Vulnerabilities catalog, exploitation attempts have persisted steadily across multiple intelligence teams from late May through October. Researchers warn that unpatched environments will likely face continued initial-access exploitation attempts from ransomware brokers over the coming quarter.

critical2 sourcesCVE-2018-13379 CVE-2019-10068 +11

Edge Appliances Face Multi-Nexus Convergence as APTs and Cybercriminals Target Identical Vendors

A collaborative study by Tenable and SentinelOne has revealed that perimeter infrastructure—including firewalls and VPN gateways—is heavily targeted by five distinct threat categories: China, Russia, North Korea, Iran, and financially motivated cybercrime groups. The findings stem from a cross-analysis of Tenable's exposure telemetry across thousands of customer environments and SentinelOne's digital forensics and incident response (DFIR) case files. Although the two data sets shared only 21% of observed Common Vulnerabilities and Exposures (CVEs), they exhibited an 79% overlap across affected vendors. For edge and remote access appliances, this vendor overlap reached 100% across Fortinet, Citrix, Ivanti, Palo Alto Networks, Cisco, Juniper, and VMware. The investigation identified 93 documented exploitation cases across roughly 40 distinct threat groups, highlighting 12 "multi-nexus" vulnerabilities confirmed to be exploited independently by both state-backed and cybercriminal actors. Notably, zero-day flaws in SonicWall SMA1000 and PAN-OS GlobalProtect were leveraged by espionage actors before being repurposed by INC Ransomware operators. Similarly, a Check Point Quantum platform vulnerability was exploited independently by a Chinese group and the Iranian threat actor Fox Kitten. Tenable's telemetry indicated that 53.8% of monitored F5 environments ran at least one active, unpatched vulnerability, while Citrix devices exhibited a median patch delay of 461 days. Additionally, Ivanti appliances demonstrated rapid vulnerability cadences, with actively exploited flaws recurring every 8.5 months on the EPMM line and every 13 months for Connect Secure.