Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
- Mentions · 7d0
- Mentions · 30d6
- All mentions10
- First seenAug 18, 2026
- Last mentioned9d ago
Timeline
10 articles · newest firstRansomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Qilin and Settra are exploiting Palo Alto GlobalProtect CVE-2026-0257 for unauthorized VPN access.
83
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.
65
New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing
Huntress details a new Settra ransomware variant deployed against retail and manufacturing victims since June, using MeshAgent RMM, recovery sabotage, and BYOVD techniques.
62
New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems
New SETTRA ransomware operation abuses MeshAgent RMM for persistence, BYOVD via gdrv.sys, log clearing, and Windows recovery sabotage to encrypt systems.
52
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.
55
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
Appears with
- Qilinthreat actor · 6
- PAN-OSproduct · 6
- ReliaQuestorganization · 6
- Palo Alto Networksvendor · 6
- GlobalProtectproduct · 5
- Prisma Accessproduct · 5
- Unit 42organization · 4
- Cobalt Strikemalware · 3
- Microsoftvendor · 3
- Rapid7organization · 3
- MeshAgentproduct · 3
- Incthreat actor · 3
- Huntressorganization · 2
- BloodHoundmalware · 2
- SharpHoundmalware · 2
- Arctic Wolforganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.