Loading story…
Arctic Wolf Labs reported multiple intrusions in which threat actors exploited CVE-2026-0257 to gain initial access to victim networks and then quickly deployed Qilin ransomware. The incidents, observed across separate organizations, followed a consistent pattern in which perimeter compromise was followed by rapid movement toward broad encryption activity.
The reporting indicates the attacks were distinct events but shared the same intrusion chain, linking exploitation of CVE-2026-0257 directly to domain-wide ransomware deployment. Arctic Wolf attributed the post-compromise activity to Qilin operations, highlighting the vulnerability as a recurring entry point in recent ransomware incidents.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added Palo Alto Networks PAN-OS GlobalProtect flaw CVE-2026-0257 to its Known Exploited Vulnerabilities catalog in early June 2026 after active exploitation was observed. The move formally recognized the bug as exploited in the wild.
Arctic Wolf Labs reported multiple intrusions in June 2026 where threat actors exploited CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect on PAN-OS, to gain initial access. The incidents shared a consistent pattern and led to Qilin ransomware deployment in victim environments.
CISA added Palo Alto Networks PAN-OS GlobalProtect flaw CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026, after exploitation in the wild was reported. The listing formally recognized the bug as actively exploited.
Rapid7 reported that broad exploitation of Palo Alto Networks PAN-OS GlobalProtect flaw CVE-2026-0257 was underway by May 17, 2026. The observation showed the vulnerability was being actively abused at scale shortly after Palo Alto Networks released fixes.
Palo Alto Networks released a patch for CVE-2026-0257, a critical authentication bypass flaw affecting PAN-OS GlobalProtect, on May 13, 2026. The vulnerability was later linked to ransomware intrusions involving Qilin.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
12 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcedarkwebinformer.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
The Qilin ransomware group, also known as Agenda, has adopted a sophisticated cross-platform attack strategy by deploying Linux-based ransomware binaries on Windows systems. This technique leverages legitimate remote management and file transfer tools such as Splashtop, WinSCP, AnyDesk, ATERA RMM, ScreenConnect, and MeshCentral to bypass traditional Windows-centric endpoint detection and response (EDR) solutions. Attackers gain initial access through social engineering, including fake CAPTCHA pages, and use credential theft to facilitate lateral movement and privilege escalation. The group also employs Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security defenses and steals backup credentials, particularly from Veeam, to prevent recovery and maximize extortion leverage. Qilin's operations have impacted over 700 victims globally since January 2025, with a focus on sectors such as manufacturing, professional and scientific services, and wholesale trade. The group uses a double-extortion model, exfiltrating sensitive data with tools like Cyberduck before encrypting files and threatening public disclosure. Qilin's affiliates have been observed using a variety of post-exploitation tools, including Mimikatz and custom scripts, to harvest credentials and exfiltrate data. The group's rapid evolution and ability to evade detection highlight the growing sophistication of ransomware-as-a-service (RaaS) operations targeting organizations worldwide.
Jun 29, 2026
**Qilin** ransomware has emerged as one of the most active cybercrime threats, with NCC Group identifying it as the most prolific ransomware group for the fifth consecutive quarter as global ransomware incidents climbed to 2,229 in Q2 2026. The group, also tracked as **Agenda** or **Qilin Locker**, operates a double-extortion **RaaS** model and has concentrated on high-GDP Western countries while reportedly avoiding CIS member states. Manufacturing and other industrial sectors have been hit hardest, alongside business services, technology, healthcare, and finance, with North America remaining the most affected region and Belgium reporting at least 15 alleged Qilin compromises that disrupted operations and exposed sensitive corporate data.
Jul 24, 2026