The VPN Bug That Won't Die: Five Months After the Patch, Ransomware Still Walks In

Five months after Palo Alto Networks shipped a patch, ransomware crews are still walking straight into corporate networks through the front door: the company's own VPN. On October 9, the threat detection firm ReliaQuest warned that at least two ransomware operations, Qilin and a newer group called Settra, are actively exploiting CVE-2026-0257, an authentication bypass in Palo Alto's GlobalProtect VPN, to open unauthorized VPN sessions and move through internal networks.

The flaw was disclosed on May 13 with a "highest" urgency rating and landed on the US government's known-exploited-vulnerabilities list two weeks later. That should have been the end of it. Instead, ReliaQuest now assesses it "highly likely" that exploitation attempts will continue for at least another three months. This is the story of why patches, even urgent ones, keep arriving too late.

A forged cookie that works as a master key

The vulnerability lives in GlobalProtect's authentication override feature, which hands authenticated users an encrypted cookie that the gateway accepts on later connections. The flaw, classified as CWE-565 (reliance on cookies without validation), sits in a function called main_DecryptAppAuthCookie. When a cookie arrives, the appliance base64-decodes it, decrypts it with the configured private key, and then trusts whatever comes out. Nothing verifies a signature. Rapid7's analysis found the decrypted content is trusted implicitly, with no signature verification of any kind.

It becomes a practical exploit because of a configuration that is common in practice: the same TLS certificate protects the public HTTPS portal and encrypts the authentication override cookie. Anyone who completes a TLS handshake with the portal can grab the public key from that handshake and forge a cookie for any account, including the local administrator. The public certificate ends up working as a master key for minting VPN credentials. Palo Alto assigned the flaw a CVSS score of 7.8 (high); the US National Vulnerability Database rated it 9.1 (critical). It affects PAN-OS versions 10.2.0, 11.1.0, 11.2.0, and 12.1.0, plus Prisma Access 10.2.0 and 11.2.0.

Four days from patch to probe

Exploitation began almost immediately. Rapid7's managed detection and response team observed the first attempts on May 17, four days after Palo Alto published its advisory. The first wave came from infrastructure hosted by Vultr and targeted local administrator accounts with forged cookies. In eight of the ten customer environments under attack, the device accepted the authentication probes. A second wave started on May 21 from Dromatics Systems infrastructure, and those attackers actually received VPN IP assignments, which put them directly on internal corporate networks. Both waves used the same spoofed MAC address, so Rapid7 assessed that a single actor was behind both.

Arctic Wolf investigated multiple intrusions through June 2026. Every one began with this flaw and ended with Qilin ransomware deployment. The attack chain was mature. Establish an SSL VPN session as a legitimate user without valid credentials. Dump credentials from Windows memory (LSASS dumping) and pull the Active Directory database (NTDS extraction) to own every domain credential. Map attack paths with BloodHound and SharpHound to find the shortest route to domain admin. Stage the ransomware payload in C:\PerfLogs\, a directory that gets little monitoring, disable Microsoft Defender's real-time protection, clear the Windows event logs with a PowerShell one-liner, then encrypt. Some intrusions were encryption-only with minimal dwell time; others were full double-extortion campaigns, with data exfiltrated to MEGA, Proton Drive, and FileZilla via Rclone before the ransomware ran.

From the network's point of view, the intruder is just another remote user.

Settra and the newer playbook

Qilin is the established operator, a ransomware-as-a-service brand with multiple affiliates. Settra is the newer entrant, first seen in June 2026, hitting organizations in consumer services, retail, and manufacturing. Analysis by Huntress shows Settra typically gains initial access through compromised VPN credentials and unpatched software, then installs "bring your own vulnerable driver" payloads to disable security software at the kernel level and deploys MeshAgent, a legitimate remote management tool, for persistent remote access.

That last detail is part of a broader pattern worth naming: ransomware operators keep folding legitimate remote management tools into their intrusions. AnyDesk, Ngrok, and LogMeIn showed up as backup access channels in the Qilin campaigns. When the attacker's tooling is the same software your IT team uses, detection based on spotting "malicious binaries" quietly stops working.

Why the hard part is noticing

The unsettling core of this campaign is that the attackers connect through the organization's own VPN, so their traffic looks like ordinary remote worker activity at the network level. Firewalls, intrusion detection systems, and VPN logs all record a successful, authenticated connection from an authorized user. A successful VPN login can no longer count as proof of legitimate access.

Defenders have to look at what happens after authentication. GlobalProtect authentication logs offer the most direct hunting ground: successful VPN sessions where the user field is null or empty, authentication events for privileged accounts from unexpected source IPs or regions, connections from hosting provider ranges like Vultr and Dromatics Systems, device hostnames that break the organization's naming conventions (investigators saw "kali", "GP-CLIENT", and "DESKTOP-GP01"), and spoofed MAC addresses. On the endpoint side, the tells are credential dumping from LSASS at unusual hours, BloodHound collectors running from temporary directories, PsExec sweeping across many systems in quick succession, and files appearing in C:\PerfLogs\.

This fits a trend that has run through 2026: ransomware operators prefer VPN appliances for initial access. Industry data cited in The CyberSec Guru's analysis puts remote access services behind roughly 87 percent of ransomware claims in 2025, with VPN compromise accounting for about 73 percent of intrusions where the entry vector could be identified. The appeal is obvious. VPN gateways face the internet by necessity, grant network-layer access to internal resources, and receive less scrutiny than endpoints.

What patching actually requires

Upgrading to a fixed PAN-OS or Prisma Access version is the only complete fix. But patching alone does not evict attackers who already established sessions. ReliaQuest's warning is explicit: patching alone may not remove access established before remediation. After patching, terminate all active GlobalProtect sessions; the patched software changes cookie generation, so every user has to re-authenticate, which is expected behavior worth warning users about in advance. Then investigate unexpected connections going back to mid-May.

If patching cannot happen immediately, the interim mitigations are configuration changes. Generate a dedicated certificate used only for authentication override cookies, stored securely and never shared with the HTTPS portal or derived from any publicly exposed certificate. Disable the authentication override feature entirely where it is not needed. Restrict portal and gateway access by IP to known corporate ranges. And add authentication layers that forged cookies cannot bypass: client certificate authentication, multi-factor authentication, or conditional access policies based on device compliance.

CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29. Five months later, the same flaw is still delivering ransomware into corporate networks. The uncomfortable lesson is that the vulnerability response pipeline worked and still lost. Disclosure, severity scoring, government mandates, fixed releases: all of it happened on schedule. What failed was the last mile. Devices that never got patched, sessions that never got terminated, certificates that never got separated. The last mile is where this battle is lost.