Originally published on satyamrastogi.com
Qilin ransomware operators exploit critical Palo Alto PAN-OS GlobalProtect authentication bypass to establish initial access. Arctic Wolf confirms active exploitation targeting enterprise VPN infrastructure.
Qilin Ransomware Exploits PAN-OS GlobalProtect Auth Bypass: Active Exploitation & Remediation
Executive Summary
Qilin ransomware gang is actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect to gain unauthorized access to enterprise networks. This represents a significant shift in ransomware operator tradecraft - moving from phishing/supply chain tactics to direct VPN exploitation. The vulnerability allows unauthenticated attackers to bypass login requirements and establish persistent access, converting what should be a perimeter defense into an attack tunnel.
