Qilin and INC are pulling domain controller credentials out of the virtual disk, with the server still running
2026-10-27Security
Unit 42 says the significant change after exploiting a PAN-OS flaw is the direct pivot to the virtualisation layer. VPN gateway to vCenter to the ESXi host, then credentials out of a VMDK that the EDR inside never sees.