When "Patched" Isn't "Protected": Inside the GlobalProtect Ransomware Wave

Five months after Palo Alto Networks disclosed and patched an authentication bypass in its GlobalProtect VPN portal, ransomware crews are still walking through the door it left open. New reporting from Cybersecurity Dive shows that researchers at Unit 42 and ReliaQuest are tracking active exploitation of the flaw, tracked as CVE-2026-0257, by at least two major ransomware operations, with a fresh wave of activity reported as recently as October 9. For a vulnerability that has been public knowledge since the spring, patch and all, that is a sobering reminder of how slowly real-world remediation actually moves.

A reliable way in, five months running

Unit 42 is tracking two ransomware groups exploiting the bug, Qilin and INC, which it labels internally as Spikey Scorpius and Tarnished Scorpius, while ReliaQuest has tied additional activity to Qilin and a group it calls Settra. Brandon Tirado of ReliaQuest's GreyMatter Operations team put it bluntly: the flaw "has become a reliable way into networks for ransomware groups," and researchers expect that to continue for at least another three months. Arctic Wolf, which began investigating Qilin-linked intrusions in June, found attack timelines ranging from fast, smash-and-grab encryption to slower double-extortion campaigns, a sign that multiple affiliates operating under a ransomware-as-a-service model are independently working the same flaw. The victims span education, financial services, healthcare, IT, manufacturing, and government, which tells you this is not a niche problem confined to one industry.

From a VPN login to a domain controller

What makes this campaign worth studying isn't just the initial access, it's what happens next. Once inside through the authentication bypass, attackers have moved methodically: harvesting credentials and pivoting with tools like Cobalt Strike, BloodHound, and SharpHound. In one case documented by Unit 42, an attacker moved from a compromised VPN session straight into a VMware vCenter appliance, disabled security controls on the underlying ESXi hypervisor, and dumped credentials offline from a domain controller's virtual disk, a technique that sidesteps endpoint detection and response tools entirely because nothing ever touches an endpoint agent. As Arctic Wolf's Justin Moore put it, access gained this way "can be quickly converted into persistent remote access," turning one unpatched edge device into a foothold for ransomware across an entire environment.

Why a known fix isn't closing the gap

The uncomfortable part of this story isn't that a vulnerability existed, it's that disclosure and an available patch didn't translate into remediation at the speed attackers are moving. Because the exploitation arrives through what looks like an ordinary VPN session, it can blend into normal remote-access traffic and go unnoticed for weeks. A public CVE, a readily available fix, and months of continued exploitation afterward: that combination is becoming a familiar pattern across edge devices and remote-access infrastructure generally, not just this one Palo Alto Networks product.

The takeaway

For any organization running VPN gateways, firewalls, or other internet-facing edge infrastructure, this is a reminder that patch management can't stop at "patch released." It needs to include verifying that the patch actually deployed everywhere it should have, hunting for signs of compromise that may have happened before the fix went in, and treating VPN and remote-access logs with the same scrutiny given to any other high-value telemetry source, because a legitimate-looking login is exactly how today's ransomware operators prefer to get in. In our technology risk work at Sage, we see this gap again and again: the distance between "a patch exists" and "the organization is actually protected" is where real exposure lives, and it is rarely closed by a single remediation cycle. If GlobalProtect or similar edge infrastructure is part of your environment, now is a good time to confirm not just that the patch is applied, but that nothing walked in before it was.

Sources: Cybersecurity Dive, "Ransomware groups expand targeting of Palo Alto Networks vulnerability" (cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474); research cited from Palo Alto Networks Unit 42, ReliaQuest GreyMatter Operations, and Arctic Wolf Labs.