Ransomware Groups Expand Targeting of Palo Alto Networks Vulnerability

Palo Alto's firewall OS has been under attack from multiple ransomware groups since June

Unit 42 investigates network compromises across numerous industries

Ransomware groups expand targeting of Palo Alto Networks vulnerability

Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal.

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware - National Cyber Security Consulting

Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity checking, which allows remote, unauthenticated attackers to bypass […] Thank you for subscribi…

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June

Several ransomware groups exploit CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions and break into corporate networks.

Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks

Ransomware operators are exploiting a Palo Alto Networks GlobalProtect VPN flaw to bypass multi-factor authentication and enter corporate networks. In one… Read more →