During June 2026, Arctic Wolf Labs investigated multiple intrusions during which threat actors exploited CVE-2026-0257 as a consistent initial access vector, rapidly transitioning from perimeter compromise to domain-wide Qilin ransomware encryption across distinct victim environments.
Key Takeaways
- Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances.
- Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella.
- Attackers demonstrated consistent operational patterns despite tradecraft variation: staging ransomware at C:\PerfLogs\, using PsExec for lateral execution via administrative shares, deploying password-protected ransomware payloads, and implementing comprehensive log-clearing routines.
- In some of the investigated intrusions, CVE-2026-0257 exploitation was observed from infrastructure self-identifying as kali hosts, with overlapping source IP addresses across intrusions suggesting shared exploitation infrastructure or tooling.
Summary
Arctic Wolf Labs observed a series of intrusions during June 2026 that culminated in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 as the initial access vector. This vulnerability affects Palo Alto Networks firewall appliances and was leveraged to gain authenticated access to victim networks through GlobalProtect VPN functionality. Once inside, the threat actors escalated to credential-driven operations including LSASS dumping and NTDS extraction, leveraging compromised administrative accounts to move laterally through Windows administrative shares.
Although the intrusions shared a common entry point and several operational hallmarks, including consistent ransomware staging paths, PsExec-based execution, and a distinctive registry persistence pattern, the post-exploitation tradecraft diverged across victims. Observed activity ranged from rapid progression to enterprise-wide encryption with minimal dwell time and no data exfiltration, to extensive reconnaissance involving deployment of multiple remote-access tools (AnyDesk, Ngrok, LogMeIn), credential harvesting at scale, and exfiltration of data to cloud storage services prior to ransomware deployment.
This variability is consistent with RaaS models, in which multiple affiliates may leverage shared initial access infrastructure and ransomware tooling while applying their own preferred post-exploitation methodologies. In this post, we break down the attack chain as observed across these intrusions and provide defensive recommendations and indicators of compromise (IOCs) that organizations can use to identify and protect themselves against related activity.
Background
What is Qilin Ransomware?
Qilin (also known as “Agenda”) is a RaaS operation that has been active since at least 2022. The group operates a double-extortion model, encrypting victim data and threatening to publish stolen information on a dedicated leak site if ransom demands are not met. Qilin has grown into one of the more prolific RaaS operations over the past twelve months, with affiliates targeting organizations across healthcare, manufacturing, education, government, and professional services sectors globally. The group recruits affiliates through underground forums and provides them with a “builder” that generates customized payloads for each operation.
Figure 1: Qilin clearnet leak site (aka WikileaksV2), where the group publishes the stolen information of those who don’t meet their ransom demands (Victim information has been redacted).
CVE-2026-0257
CVE-2026-0257 (CVSS Score: 7.8/High) is an authentication bypass vulnerability affecting the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS. The vulnerability is exploitable when authentication override cookies are enabled with specific certificate configurations. Successful exploitation allows unauthenticated remote attackers to bypass authentication and establish VPN sessions without valid credentials.
Affected Versions:
- PAN-OS 12.1 (before 12.1.4-h6 or 12.1.7)
- PAN-OS 11.2 (before 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 12)
- PAN-OS 11.1 (before 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15)
- PAN-OS 10.2 (before 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6)
- Prisma Access 10.2.0 through 10.2.10-h35, 11.2.0 through 11.2.7-h12
Not Affected: Cloud NGFW, Panorama
Palo Alto Networks has confirmed limited active exploitation on unpatched devices. In the intrusions observed by Arctic Wolf, successful exploitation allowed threat actors to establish authenticated GlobalProtect VPN sessions, bypassing perimeter authentication controls entirely and providing direct interactive access to victim networks.
Technical Details
Initial Access: Exploiting the Cookie
Across the investigated intrusions, CVE-2026-0257 served as the confirmed or assessed initial access vector. Arctic Wolf identified indicators of exploitation activity originating from numerous external IP addresses, indicating broad scanning and exploitation targeting vulnerable GlobalProtect deployments. External source IPs associated with exploitation attempts are detailed in the IOCs appendix on our public GitHub.
Following successful exploitation, threat actors established SSL VPN sessions from systems self-identifying with the hostname kali, a detail observed in some of the investigated intrusions and consistent with the use of Kali Linux as an attack platform. VPN session source IPs included 108.61.229[.]217, 108.61.75[.]232, 2.188.33[.]52, 199.247.22[.]193, and 70.34.205[.]43, all establishing sessions from kali-identified systems.
Several IP addresses appeared both as external exploitation sources and as subsequent VPN session origins, confirming the same infrastructure was used for both vulnerability exploitation and post-compromise access. This overlap, combined with the consistent kali hostname across intrusions, suggests either a shared exploitation toolkit or coordinated infrastructure among threat actors targeting this vulnerability.
Establishing a Foothold: Persistence and Remote Access
With authenticated VPN access established, the threat actors moved quickly to ensure they would not lose their foothold if the VPN session was terminated or the vulnerability patched.
We observed a consistent pattern in the registry Run key’s values used for persistence: this consisted of an asterisk followed by six randomized lowercase alphabetic characters (pattern: *[a-z]{6}). This distinctive naming convention was observed across multiple intrusions and may represent a Qilin-builder-specific configuration artifact. The associated execution command observed in registry artifacts pointed directly to the staged ransomware payload:
C:\PerfLogs\win.exe --password [REDACTED] --no-admin
In one instance, a scheduled task named \MeshUserTask was observed, consistent with MeshAgent (an open-source remote management agent) being deployed for persistent access.
Beyond built-in persistence mechanisms, threat actors deployed multiple remote access tools to maintain redundant connectivity. AnyDesk was observed at multiple file paths, suggesting repeated deployment or attempts to evade path-based detections:
C:\ProgramData\AnyDesk\AnyDesk.exe C:\PerfLogs\AnyDesk.exe C:\Windows\Temp\AnyDesk.exe C:\Program Files (x86)\AnyDesk\AnyDesk.exe
Ngrok, a tunneling utility that exposes local services through public endpoints, was also observed being deployed with the associated configurations:
ngrok.exe ngrok.yml
LogMeIn was also deployed, providing yet another remote access pathway and demonstrating a layered approach to persistence where the loss of any single mechanism would not result in loss of access.
Harvesting Credentials: LSASS and NTDS Extraction
With persistent access secured, the threat actors turned to credential harvesting, a prerequisite for the credential-driven lateral movement that followed.
The threat actors dumped credentials from the Local Security Authority Subsystem Service (LSASS) process memory using a technique involving rundll32.exe and comsvcs.dll:
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump [LSASS_PID] C:\Windows\Temp\output.odt full
This was executed through a Windows service with a randomized service name, consistent with remote service creation via tools like PsExec or sc.exe. The output was written to a .odt file, an unusual extension choice likely intended to avoid detection by file-type-based monitoring rules that alert on .dmp extensions.
Domain-level credential theft was achieved via ntdsutil.exe using the Install From Media (IFM) method, providing access to every account in the domain:
ntdsutil.exe "activate instance ntds" "ifm" "create full C:\Windows\Temp\NTDS" quit quit
This command creates a full copy of the Active Directory database including all domain account password hashes. Artifacts from this activity were observed at:
- C:\Windows\Temp\NTDS\
- C:\audit\Active Directory\ntds.dit
The combination of LSASS dumping for immediate credential access and NTDS extraction for comprehensive domain compromise provided the threat actors with the authentication material needed to move freely across victim environments.
Reconnaissance and Lateral Movement
With credentials in hand, threat actors conducted network reconnaissance and moved laterally through victim environments using the harvested administrative accounts.
Network Discovery
Shellbag artifacts and Windows registry keys that record folder navigation history revealed that the threat actors manually browsed the file system through an interactive session. The navigation pattern shows deliberate staging-location validation:
- C:\PerfLogs
- Downloads
- \\[host]\c$
- \\[host]\c$\Windows
- \\[host]\c$\Windows\Temp
- \\[host]\c$\PerfLogs\Admin
This activity demonstrates the threat actors validated write access to C:\PerfLogs and explored administrative shares on remote systems; reconnaissance conducted prior to staging ransomware and moving laterally in the compromised environments.
The SoftPerfect Network Scanner (netscan.exe) was deployed to identify accessible systems on the network. This tool was observed at multiple locations:
C:\Windows\Temp\New scan\netscan.exe C:\Users\[REDACTED]\Desktop\New scan\netscan.exe
Additionally, NetExec (nxc.exe) was used for network enumeration and credential validation. NetExec is an actively-maintained successor to CrackMapExec commonly used by both penetration testers and threat actors for enumerating Windows networks, validating credentials, and executing commands remotely.
Credential-Driven Lateral Movement
Lateral movement was credential-driven across the investigated intrusions. PsExec (the Sysinternals remote execution utility) was the primary mechanism, evidenced by the PsExec service executable:
%SystemRoot%\PSEXESVC.exe C:\Windows\PSEXESVC.exe
The threat actors used PsExec in conjunction with Windows administrative shares (C$) to transfer tools and execute commands on remote systems. This pattern of transferring executables to remote systems via C$ and executing them through PsExec was consistent across the intrusions and represents the primary lateral movement mechanism.
Microsoft Remote Desktop Protocol (RDP) was used as a secondary lateral movement method. In some intrusions, both successful and denied RDP connection attempts were observed, indicating the threat actors attempted lateral movement to systems where their compromised credentials lacked authorization. RDP complemented PsExec for interactive access to critical systems including domain controllers, backup infrastructure, and file servers.
Compromised administrative credentials were used as the primary expansion mechanism, with network logon (Logon Type 3) activity observed against workstations, servers, and virtualization hosts throughout the environment.
Covering Tracks: Defense Evasion
Before deploying ransomware, the threat actors took the following deliberate steps to reduce the likelihood of detection and eliminate forensic evidence:
Enterprise-Wide Event Log Clearing
A PowerShell routine was executed that systematically enumerated and cleared all Windows event logs containing records. This is more thorough approach than the clearing of only Security, System, or specific logs:
$logs = Get-WinEvent -ListLog * |
Where-Object {$_.RecordCount} |
Select-Object -ExpandProperty LogName ;
ForEach ($l in $logs | Sort | Get-Unique)
{
[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)
}
This command works by enumerating every registered event log channel on the system, filtering to only those containing records, and then clearing each one via the .NET EventLogSession API. In practice, this lets the threat actors wipe evidence across the entire forensic surface in one action; not just Application or Security logs, but peripheral channels like PowerShell/Operational, Task Scheduler, and Terminal Services that investigators might otherwise rely on when primary logs are gone.
Selective Log Clearing
Another approach involved targeted clearing of Security, System, and PowerShell logs using a threat actor-controlled account. Although less extensive than the enterprise-wide routine above, it still removed the most valuable forensic log sources.
Defender Real-Time Protection Disablement
Microsoft Defender Real-Time Protection was disabled prior to ransomware deployment in some cases, reducing the likelihood of payload detection during execution.
Data Exfiltration
In intrusions involving double-extortion, data exfiltration occurred prior to ransomware deployment, consistent with Qilin’s operational model.
Multiple tools were deployed for data theft:
- Rclone (C:\Windows\Temp\rclone.exe): a command-line program for managing and transferring files to cloud storage. Microsoft Defender flagged associated activity as Behavior:Win32/SuspRclone.A.
- ProtonDrive (ProtonDrive.exe): the Proton Mail encrypted cloud storage client.
- FileZilla (FileZilla.exe): an open-source FTP client.
MEGA, a legitimate cloud storage service, was the primary exfiltration destination. Although widely used legitimately, its end-to-end encryption, large storage, and minimal identity verification attract threat actors for data exfiltration. The threat actors used Rclone to transfer stolen data directly to MEGA’s storage infrastructure. The rapid, frequent transfers from critical infrastructure indicate sustained automated operations rather than isolated uploads.
Communications were observed to MEGA’s globally distributed infrastructure across multiple geographic regions (Amsterdam, Brussels, Montreal, Vancouver). The IP addresses involved are legitimate MEGA infrastructure endpoints listed in the indicators of compromise appendix. These indicators are not inherently malicious and represent MEGA’s legitimate service infrastructure. However, high-volume outbound transfers to these endpoints from domain controllers, file servers, or other systems that do not typically interact with cloud storage services should be considered anomalous and investigated.
The threat actors targeted the Veeam backup infrastructure before deploying ransomware to eliminate recovery options and pressure the victim to pay.
Not all investigated intrusions involved data theft. Forensic evidence showed cases of encryption without data exfiltration. This variability shows that individual affiliates under the Qilin RaaS model may have different objectives or time constraints.
Ransomware Deployment
After gaining access to victim environments with validated credentials, establishing persistence, and sometimes exfiltrating data, the threat actors deployed ransomware.
Staging
Across all of the observed intrusions, the Qilin ransomware payload was consistently named win.exe and staged at deliberate locations:
C:\PerfLogs\win.exe \\[host]\c$\Windows\Temp\win.exe
The choice of C:\PerfLogs\ as a staging directory is worth noting. This directory exists by default on Windows systems, is rarely monitored by file-integrity solutions, is writable without elevated privileges in many setups, and was confirmed by the threat actors through interactive exploration (via Shellbag artifacts) before use.
Execution
The Qilin payload accepts command-line parameters to control execution, including password gating and administrative privilege handling, following a builder model where each operation uses a uniquely configured binary. The threat actor executed the payload using a password gate, a 32-character mixed-case alphanumeric string with special characters that must be provided at runtime for the binary to execute. Without this key, the payload is inactive, complicating sandbox analysis and incident responder triage.
The –no-admin flag skips requesting elevated privileges to avoid UAC prompts that might alert monitored systems, as shown below:
C:\PerfLogs\win.exe --password [REDACTED] --no-admin
This process was invoked via C:\Windows\SysWOW64\cmd.exe, a 32-bit binary on 64-bit systems.
Encryption
Encrypted files received extensions in the format of a period and dash followed by a random alphanumeric string. This extension format is typical of Qilin ransomware campaigns, where each operation has a unique extension identifier. The extension remained consistent across all affected files within a single intrusion.
Figure 2: Qilin attack chain sequence (Click to enlarge).
How Arctic Wolf Protects Its Customers
Arctic Wolf is committed to ending cyber risk. When we identify active threats, we act quickly to protect our customers. We have used threat intelligence around this activity to improve detections in the Aurora® Superintelligence Platform, subject to customer environment and available telemetry. As the threat evolves, Arctic Wolf may update detections for new indicators of compromise and tactics used by these actors.
Defensive Guidance
The following recommendations prioritize techniques observed in these intrusions, each linked to documented cases.
High Priority: Hardening
- Patch CVE-2026-0257 immediately. The most crucial mitigation is applying the vendor patch for CVE-2026-0257 on all internet-facing Palo Alto Networks firewall appliances running affected PAN-OS versions (12.1, 11.2, 11.1, 10.2) and Prisma Access. This vulnerability was the initial access vector in the investigated intrusions. After patching, follow vendor guidance to terminate all active GlobalProtect sessions to immediately invalidate unauthorized sessions. As a mitigation, organizations can disable authentication override options or use dedicated certificates for authentication override cookies.
- Review VPN authentication logs for anomalous sessions. Specifically hunt for:
- VPN sessions originating from hosting provider or VPS IP ranges (many exploitation source IPs in these intrusions resolved to hosting providers)
- Sessions with machine hostnames of kali or Windows-default format (DESKTOP-[ALPHANUMERIC])
- Multiple internal VPN address assignments in sequence from the same source
- GlobalProtect authentication events from sources that do not match expected user locations or network providers
- Rotate all credentials if exploitation of CVE-2026-0257 is suspected. If exploitation is confirmed, assume full domain compromise due to attackers escalating to credential harvesting (LSASS dumping, NTDS extraction). This includes:
- All domain administrative account passwords
- The KRBTGT account (twice, per Microsoft guidance)
- Service account passwords
- Any credentials for cloud storage services (MEGA, ProtonDrive, FileZilla server configurations)
- Monitor and restrict access to C:\PerfLogs\. This directory was consistently used for ransomware staging across the observed intrusions. Implement:
- File-integrity monitoring on C:\PerfLogs\ for any executable file creation
- Application control policies that block execution from C:\PerfLogs\
- Alerting on processes spawned from this directory
- Block or alert on administrative share access patterns consistent with lateral movement:
- Remote file writes to C$\Windows\Temp\ or C$\PerfLogs\ from non-administrative workstations
- PSEXESVC.exe creation on systems where PsExec is not operationally sanctioned
- Logon Type 3 activity across many systems from a single source in a short window
- Implement network-level controls for remote access tools. Block or alert on:
- AnyDesk, Ngrok, and LogMeIn traffic from systems where these tools are not business-sanctioned
- Outbound connections to MEGA storage infrastructure
- Rclone command-line execution or network signatures
- Forward Windows Event Logs to a centralized SIEM in real time. The enterprise-wide log-clearing routine in these intrusions removes local forensic evidence. Centralized log forwarding preserves data for detection and investigation even if local logs are cleared. Organizations should monitor for Windows Security Event ID 1102 (audit log cleared), as this is an uncommon administrative action that should trigger immediate investigation. Similar alerts should be generated for the disabling of security tools or services. When these activities occur across multiple systems, they should be treated as a potential indicator of adversary presence and lateral movement within the environment.
Structural
- Restrict NTDS.dit access. Monitor exe execution with IFM-related arguments and alert on Volume Shadow Copy access to the NTDS.dit file path. Restrict privileges for DCSync or IFM operations to specific accounts.
- Maintain and test an incident response plan with specific playbooks for ransomware scenarios. Because dwell time varies, from rapid encryption to prolonged operations with exfiltration, early detection during credential access or lateral movement is crucial to prevent irreversible damage.
Conclusion
The June 2026 intrusions using CVE-2026-0257 and leading to Qilin ransomware deployment show ongoing ransomware operations exploiting perimeter vulnerabilities for initial access. The repeated use of this exploitation vector and overlapping infrastructure indicators suggest either coordinated activity by a single threat actor with CVE-2026-0257 capabilities, or shared exploitation infrastructure enabling Qilin ransomware deployment.
The variability in post-exploitation tradecraft, from encryption-only operations to full double-extortion, shows that perimeter compromise is the critical point for defenders. After exploitation succeeds, the impact depends on the affiliate’s goals and timeline, but domain compromise and ransomware deployment are consistent. Organizations that detect and respond during initial access or early credential access can prevent irreversible encryption and data theft.
Arctic Wolf Labs assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing. This assessment is based on the extensive scanning activity observed and the RaaS model’s tendency to distribute successful exploits among multiple affiliates.
We will continue to monitor related activity and will update detections and guidance as new intelligence emerges.
Appendix
For Appendix sections referenced in this report, including MITRE ATT&CK® mapping, tools observed, and indicators of compromise, please see our public GitHub repository.
Legal disclaimer: Attribution reflects Arctic Wolf Labs’ assessment as of the report period and may evolve with new evidence. References to threat actor identity, nexus, and intent are analytical judgments, not statements of legal fact. This alert is provided for informational purposes only and does not constitute a guarantee of detection or prevention. Defensive effectiveness varies by environment, configuration, and available telemetry.
Additional Arctic Wolf Resources:
- Security Bulletin: Arctic Wolf Observes an Increase in Palo Alto Networks GlobalProtect Authentication Bypass Exploitation via CVE-2026-0257 (June 11, 2026)
- Security Bulletin: CVE-2026-0257: PAN-OS GlobalProtectAuthentication Bypass (June 4, 2026)
- Arctic Wolf Tech Den
- Arctic Wolf Blog
About Arctic Wolf Labs
Arctic Wolf Labs is a group of elite security researchers, data scientists, and security development engineers who explore security topics to deliver cutting-edge threat research on new and emerging adversaries, develop and refine advanced threat detection models with artificial intelligence and machine learning, and drive continuous improvement in the speed, scale, and detection efficacy of Arctic Wolf’s solution offerings.
Arctic Wolf Labs brings world-class security innovations to not only Arctic Wolf’s customer base, but the security community at large.
