Spikey Scorpius

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenOct 19, 2026
Last mentioned5d ago

Timeline

2 articles · newest first

Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA

Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.

GBHackersupdated 17:19 UTC · 3h agofirst Oct 20, 12:30 UTC · 5d agoExploit / PoCExploited19 sourcesCVE-2026-0257 CVE-2023-275321 · 1 read

Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257

Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.

Palo Alto Unit 42updated 17:19 UTC · 3h agofirst Oct 19, 22:35 UTC · 5d agoExploit / PoCExploited19 sourcesCVE-2026-0257 CVE-2023-275326 · 3 reads

Related CVEs

by mentions

CVE-2026-025797%7.8
Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
published May 13, 2026Palo Alto Networks PAN-OS (GlobalProtect portal and gateway)KEVRansomware
CVE-2023-2753281%7.5
Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
published Mar 10, 2023Veeam Backup & ReplicationKEVRansomware

Appears with

PAN-OSproduct · 2
Unit 42organization · 2
Tarnished Scorpiusthreat actor · 2
Qilinthreat actor · 2
GlobalProtectproduct · 2
Palo Alto Networksvendor · 2
Settramalware · 2
Veeamvendor · 1
Incthreat actor · 1
CISAorganization · 1

Entities are extracted by the model from each article. First seen Oct 19, 2026, last mentioned 5d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.