Unit 42 has updated its research on CVE-2026-0257, the authentication bypass in PAN-OS and Prisma Access that Palo Alto Networks patched in May. Its finding on who is using it is blunt: "Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC)."

The flaw is scored 7.8 and has been on CISA's exploited catalogue since 13 May 2026. Everything interesting here happens after it.

The flaw is old, the technique is not

Initial access is the bypass, used to stand up an unauthorised VPN session, which also gets the attacker past multi-factor authentication. From there: reconnaissance with dual-use remote monitoring tools, lateral movement over RDP and SMB, then staging for credential theft and encryption. Every step of that has been avoidable since the patch shipped in May, against a flaw scored 7.8.

Readers who saw yesterday's piece on the k0t campaign will recognise the CVE. The same flaw, a different set of operators, and a technique that is further along.

The pivot

Unit 42 calls "the direct pivot to the virtualization layer" the most significant change in tactics after exploitation, and the described case runs in 3 steps. From the VPN gateway the attackers reached a vCenter management appliance. From vCenter they disabled security controls on the ESXi hosts underneath it. Then a custom tool dumped credentials offline from a domain controller's virtual disk, the VMDK file.

The domain controller was running the entire time. Nothing was executed inside it.

Why the agent inside sees nothing

Endpoint detection runs inside the guest. It watches processes, memory and file access on the machine it is installed on, and it is good at that.

A VMDK is 1 file on a datastore, underneath the guest. Reading it is an operation at the hypervisor layer, performed by something the guest cannot observe, on storage the guest does not know it is sitting on. The domain controller's agent reports a quiet, healthy machine, because from where it is standing the machine is quiet and healthy.

What comes out of that file is the credential database. Not one account. Every account in the domain.

What it gets chained with

The same operations chain the access with CVE-2023-27532 in Veeam, which is a backup product, because backups are both a source of credentials and the thing a victim needs intact to refuse a ransom.

The sectors Unit 42 lists are not a pattern so much as a list of everybody: education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, retail.

What to do

  • Patch PAN-OS. The fix has been available since May and the flaw has been on the catalogue since 13 May.
  • Treat vCenter as a tier-zero system, with the same access controls, logging and separation as a domain controller. It can read every domain controller you own.
  • Alert on ESXi security control changes, on SSH being enabled, and on new local accounts at the hypervisor layer. Those are the events the guest agent cannot generate.
  • Restrict and monitor datastore browsing. Copying a VMDK is a normal administrative action and an abnormal one when nobody scheduled it.
  • Check Veeam against CVE-2023-27532 while you are in there.
  • Assume a domain-wide credential reset is the response if this happens, not a targeted one.

What is not established

  • How many organisations have been hit this way. Unit 42 gives sectors and no counts.
  • What the custom VMDK tool is, or whether it is shared between the two groups.
  • Whether Qilin and INC developed the technique independently or acquired it.
  • How the MFA bypass works in detail. The reporting does not say.
  • Whether the k0t activity against the same CVE is related to either group.

Unit 42's own post was not retrieved for this piece; the quotations above are as the reporting of it carries them.