Qilin And Settra Exploit Patched Palo Alto VPN Flaw Arabian Post

(MENAFN- The Arabian Post) clearfix"> Ransomware operators Qilin and Settra are exploiting a five-month-old vulnerability in Palo Alto Networks' remote-access software to penetrate corporate networks, cybersecurity company ReliaQuest warned on 9 October.

The activity targets CVE-2026-0257, an authentication bypass flaw affecting certain configurations of GlobalProtect, the virtual private network service used by organisations to give employees access to internal systems. Palo Alto Networks issued fixes on 13 May, but attacks against unprotected installations have continued.

ReliaQuest identified both ransomware operations among groups using the weakness to establish unauthorised VPN sessions. It also observed offensive security tools including Cobalt Strike, BloodHound and SharpHound, which can help intruders maintain access, examine network relationships and identify routes towards more sensitive systems.

MENAFN12102026000152002308ID1111796505