A high-severity flaw in Palo Alto Networks' GlobalProtect VPN software is being actively weaponized by ransomware crews to walk past multi-factor authentication and land directly inside corporate networks. Unit 42, the company's threat intelligence arm, disclosed in an October 19 update that two ransomware-linked groups, tracked as Spikey Scorpius and Tarnished Scorpius, have exploited the bug, with separate reporting tying it to a third operator using Settra ransomware. Investigations into the activity have been running since early June and span healthcare, education, finance, manufacturing, government, and energy organizations.
How a Login Shortcut Became a Backdoor
The vulnerability, cataloged as CVE-2026-0257, hinges on a convenience feature called an authentication override cookie. These cookies let a user who already logged in reconnect without repeating the full password-and-MFA sequence, sparing them friction on subsequent connections. The design assumes the cookie can only have been issued by a trusted gateway. According to technical analysis from Rapid7, that assumption breaks down on vulnerable devices: the system decrypts the cookie but fails to properly confirm it actually came from a legitimate source.
That gap becomes exploitable when the same certificate used to generate these cookies is reused elsewhere on a publicly reachable service. An attacker who obtains the certificate's public key can forge a convincing cookie from scratch. Presented to the gateway, it is accepted as valid proof of a prior login, granting a VPN session without ever touching a password field or an MFA prompt. Palo Alto Networks has rated the flaw High severity, with a CVSS score of 7.8, and assigned it its most urgent response classification. The exposure applies specifically to GlobalProtect portals and gateways running certain PAN-OS and Prisma Access configurations where override cookies are enabled alongside a susceptible certificate setup; Panorama and Cloud NGFW deployments are not affected.
From Network Access to a Domain Controller's Hard Disk
Once inside, attackers do not rush. Unit 42's investigations describe a methodical progression: remote monitoring and management tools are deployed to map the internal environment, followed by lateral movement using Remote Desktop Protocol and Server Message Block to reach additional systems. Only then do credential harvesting and data theft tools get staged ahead of ransomware deployment.
The most striking case documented involved a pivot from the compromised VPN gateway straight to VMware's vCenter management appliance. From there, attackers disabled a built-in safeguard called execInstalledOnly on the underlying ESXi hosts and used a custom tool to pull credentials directly off a domain controller's virtual disk file, offline. This technique matters because it never touches the operating system running inside the virtual machine. Endpoint detection and response software installed on that domain controller has nothing to detect, since the attack targets the storage layer beneath it rather than any process running within it.
Unit 42 also observed the same intrusion chains extending toward Veeam backup infrastructure through a separate, previously known flaw, CVE-2023-27532, which can expose encrypted credentials stored in backup configuration databases and potentially hand attackers a path into backup hosts themselves, undermining recovery options before ransomware is even deployed.
What Organizations Should Check Now
Palo Alto Networks is urging immediate patching of every affected GlobalProtect portal and gateway. Where upgrading cannot happen immediately, disabling authentication override entirely, or issuing a certificate used exclusively for override cookies rather than shared across services, closes the exploitation path.
- Review GlobalProtect logs for successful gateway-connected events tied to unfamiliar source addresses or client details
- Watch for reported indicators including the IP addresses 104.207.144[.]154 and 146.19.216[.]125
- Flag device names such as GP-CLIENT and DESKTOP-GP01, and host identifiers aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55
- Treat VMware vCenter and ESXi access logs as a priority given the documented pivot from VPN compromise to virtual infrastructure
Earlier monitoring found that many probing attempts against the flaw never escalated into full VPN sessions, which is precisely why successful connection events, however routine they look, deserve closer scrutiny. The case illustrates a broader shift in ransomware tradecraft: attackers increasingly bypass the controls defenders trust most, not by breaking them outright, but by exploiting the quiet assumptions those controls were built on.
