Ransomware Crews Use Palo Alto PAN-OS Flaw to Reach Domain Credentials

Ransomware crews are still breaking into US corporate networks through a flaw in Palo Alto Networks' PAN-OS software, and they have moved past the VPN gateway into the virtual servers behind it. The Palo Alto PAN-OS ransomware campaign, as Unit 42 describes it, is continuing and has widened. The operators it names include Qilin and INC, two groups that USA 24 has covered before, and the newest research shows a more serious next step: domain credentials pulled from virtual infrastructure.

Unit 42, the threat intelligence and incident response arm of Palo Alto Networks, has tied the activity to a flaw that the company first patched in May. Andy Piazza, the team's senior director of threat intelligence, described the bug as an "initial foothold into corporate networks," according to The Register. The attackers use the flaw to get in, then bypass multi-factor authentication to establish a VPN session. That sequence is what makes this campaign dangerous, because MFA is often the control that stops a stolen password from turning into a working session.

Palo Alto PAN-OS ransomware: a timeline that starts in May

Palo Alto disclosed and patched the flaw on May 13, 2026, and initially rated it medium severity. At the time, the company said it was aware of attempts to exploit the bug but had not observed any malicious exploitation.

That changed quickly. Rapid7 researchers later reported successful exploitation across multiple customer environments, with activity dating back to at least May 17. The rest of the timeline has built on that date:

• May 13, 2026: Palo Alto Networks discloses and patches the PAN-OS flaw, rated medium severity.
• May 17, 2026: The earliest exploitation date reported by Rapid7.
• Oct. 14, 2026: CISA adds CVE-2026-0322, a Palo Alto PAN-OS code injection flaw, to its Known Exploited Vulnerabilities catalog.
• Oct. 19, 2026: Unit 42 says in a Monday statement that Qilin and INC continue to exploit the vulnerability.
• Oct. 22, 2026: Unit 42 publishes its latest research on the campaign.

The Register's headline dates the campaign to June, but the earliest date in the reporting reviewed for this story is May 17. That gap matters for defenders. A medium rating often pushes a patch into a normal maintenance window, while an active-exploitation signal pulls it into an emergency change. Teams that kept the May rating without rechecking it may have left vulnerable gateways in service for months.

From VPN login to domain credentials

The most significant change in the reporting is what happens after the VPN door opens. According to Unit 42's research blog, as reported by Hackread, attackers who exploited the PAN-OS flaw began targeting virtual server infrastructure. They then extracted domain credentials from a domain controller's virtual disk.

Domain credentials are the keys to most Windows environments. Whoever holds them can move between systems, reach domain controllers and hypervisors, and find the backups an organization would use to recover. That raises the cost of an incident, because restoring a network after a domain takeover means rebuilding trust across every system that depends on it. A VPN compromise that stays at the edge is a bad day. One that reaches the domain is a recovery project that can run for weeks.

Unit 42 also saw attackers using exploit tools aimed at Veeam backup infrastructure, including CVE-2023-27532. That flaw can expose encrypted credentials stored in Veeam's configuration. Backup servers are a common ransomware target for a simple reason: they hold the copies a victim would restore from.

Edge devices have become a repeated entry point. USA 24's coverage of a Citrix NetScaler zero-day still planting web shells on US VPN gateways and Fortinet's emergency FortiOS patches that shipped before the flaws were named shows the same pattern. The gateway is the target, and the time between disclosure and mass exploitation can be short.

The CVE number does not match across sources

Hackread names the PAN-OS flaw as CVE-2026-0257. CISA's October 14 catalog update lists CVE-2026-0322 for a Palo Alto PAN-OS code injection bug. These may be two separate flaws, or one identifier may be wrong in the coverage. The full Unit 42 blog post was not available for this report, so the details here come from secondary coverage.

Confirm which identifier the vendor advisory uses before you rely on either number in a ticket, a scanner rule or a patch report. A wrong CVE can send a team to patch the wrong device or close a finding too early.

Who is exposed and what to check now

Any US organization running affected PAN-OS VPN gateways is at risk, especially those with remote-access setups that depend on MFA. Healthcare, finance and government networks are high-value targets for this kind of intrusion. The reporting so far does not name specific US victims or give a count of compromised organizations, so the scale of the campaign is unknown.

Work through these checks in order:

• Confirm your PAN-OS version against the vendor advisory, and note which CVE identifier that advisory uses.
• Review VPN session logs for connections from unfamiliar sources or unusual hours dating back to May 2026.
• Check domain controller and hypervisor logs for signs of credential access.
• Verify that MFA is enforced on every VPN path, not only the main login portal.
• Rotate domain and service-account credentials if you find any sign of compromise.
• Check backup servers for Veeam CVE-2023-27532 and patch them if they are exposed.

CISA's KEV catalog lists vulnerabilities with evidence of active exploitation, and federal agencies must prioritize them under BOD 26-04. Private organizations can use the same list as a patch queue. If a PAN-OS entry is on the list, treat it as an emergency rather than a routine update.

What to watch next

Three developments will matter most. The first is whether Unit 42's full post and the vendor advisory settle the CVE question, since scanners and asset inventories depend on the right identifier. The second is whether Qilin and INC are working together or separately, which the current excerpts do not make clear. The third is whether this step into virtual infrastructure spreads to other ransomware groups.

If the pattern holds, the next question for defenders will not be whether their VPN gateways face attack, but how quickly they can prove their domain controllers were never part of the path. Teams that can answer that question with logs, rather than assumptions, will recover faster than those that cannot.