Ransomware Gangs Exploit VPN Flaw to Log In Like Legitimate Staff

The Hacker News weekly ThreatsDay bulletin reports that the Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access. The flaw was disclosed in May 2026 and has since come under active attack. Because the access comes through an organisation's own VPN, ReliaQuest warns that malicious activity can look like normal remote work and may go unnoticed until credential theft, lateral movement, data theft or ransomware deployment is already underway.

ReliaQuest advises affected organisations to upgrade immediately and to disable authentication override cookies where they are not needed. It also recommends ending all active GlobalProtect sessions after patching and investigating unexpected connections, including sessions using hostnames such as "kali". Importantly, patching alone may not remove access that an attacker established before the fix was applied.

The same bulletin notes a Recorded Future assessment that Russia has escalated hybrid, asymmetric warfare across Europe since its full-scale invasion of Ukraine in February 2022. Recorded Future describes this as a mix of psychological, cyber and physical tactics aimed at testing defences, degrading critical infrastructure and creating fear. This is only the opening of a longer weekly roundup, so other items in the bulletin are not covered here.