Recent intelligence from Arctic Wolf confirms that the Qilin ransomware-as-a-service (RaaS) operation is actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN. This represents a significant escalation in threat actor behavior, moving from opportunistic scanning to targeted, credential-less access into corporate networks. For defenders, this is a "drop everything" moment: the perimeter is being actively breached by a known encryption-based cyber incident gang.
The implications are severe. An authentication bypass flaw allows attackers to establish a foothold without valid credentials, effectively rendering Multi-Factor Authentication (MFA) moot for the initial access vector. Once inside the VPN perimeter, Qilin actors typically move laterally to deploy ransomware. Given the sophistication of this group, defenders must assume that any unpatched GlobalProtect gateway exposed to the internet is currently under active attack or already compromised.
Technical Analysis
Affected Component: PAN-OS GlobalProtect Gateway and GlobalProtect Portal services.
Vulnerability Class: Authentication Bypass. The specific flaw allows unauthenticated, remote attackers to bypass the authentication mechanisms of the GlobalProtect service. While the specific CVE identifier is not detailed in the current reporting, the technical behavior involves sending crafted requests to the VPN interface that the system mistakenly treats as valid, authorized sessions.
Attack Chain:
- Reconnaissance: Threat actors scan for exposed PAN-OS interfaces on UDP ports 4501, 443 (TCP), or other custom GlobalProtect ports.
- Exploitation: A malicious packet is sent to the GlobalProtect service triggering the authentication bypass.
- Persistence: The attacker establishes a valid VPN session, gaining internal network access.
- Lateral Movement: Using the foothold, the actor performs internal discovery (LDAP scanning, SMB enumeration) and moves toward high-value assets to deploy Qilin ransomware payloads.
Exploitation Status: Confirmed Active Exploitation in the wild (ITW). Arctic Wolf has observed Qilin utilizing this specific flaw to breach victims. This is not theoretical; it is an ongoing campaign.
Detection & Response
Detecting this exploitation requires a two-pronged approach: identifying the anomalous authentication activity on the network and hunting for the post-exploitation presence of Qilin ransomware on endpoints.
SIGMA Rules
---
title: Potential PAN-OS GlobalProtect Authentication Bypass
id: 8a4b2c1d-9e6f-4a3b-8c2d-1a2b3c4d5e6f
status: experimental
description: Detects potential authentication bypass attempts on PAN-OS GlobalProtect services characterized by successful session establishment without preceding successful authentication events or from impossible geographies.
references:
- https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
- cve.2025.placeholder
logsource:
category: firewall
product: paloalto
detection:
selection:
operation: 'GlobalProtect'
action: 'success'
result|contains: 'tunnel established'
filter_legit:
src_user|contains: '@'
condition: selection and not filter_legit
falsepositives:
- Legacy device authentication configurations not using UPN format
level: critical
---
title: Qilin Ransomware Payload Execution
id: 9c5d3e2f-0f7a-5b4c-9d3e-2b3c4d5e6f7a
status: experimental
description: Detects execution patterns associated with Qilin ransomware, specifically targeting unusual process spawning from system binaries or the presence of known Qilin CLI arguments.
references:
- https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.impact
- attack.t1486
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\rundll32.exe'
- '\powershell.exe'
- '\cmd.exe'
selection_cli:
CommandLine|contains:
- '-enc '
- 'Invoke-AESEncryption'
- 'qilin'
condition: all of selection_*
falsepositives:
- Legitimate administrative encryption scripts
level: high
KQL (Microsoft Sentinel / Defender)
// Hunt for anomalous GlobalProtect logins suggesting bypass
// Focus on successful tunnel establishment missing typical auth logs
let TimeRange = 1h;
CommonSecurityLog
| where TimeGenerated > ago(TimeRange)
| where DeviceVendor =~ "Palo Alto Networks"
| where DeviceProduct =~ "GlobalProtect"
| parse DeviceAction with * "tunnel established" *
| where DeviceAction contains "tunnel established"
| project TimeGenerated, SourceIP, DestinationIP, DeviceAction, ExtID
| join kind=leftanti (
SecurityEvent
| where TimeGenerated > ago(TimeRange + 5m)
| where EventID == 4624
| where LogonType == 8 or LogonType == 10 // Network/Cleartext
| extend SourceIP = IpAddress
) on SourceIP
| distinct SourceIP, TimeGenerated, DeviceAction
Velociraptor VQL
-- Hunt for Qilin ransomware file extensions and processes
SELECT OSPath, Mtime, Atime, Size, Mode
FROM glob(globs='\\C\Users\*\*.qilin')
WHERE Mtime > now() - 7d
SELECT Pid, Ppid, Name, CommandLine, Exe
FROM pslist()
WHERE Name =~ 'rundll32.exe'
AND CommandLine =~ '.dll'
AND Exe NOT IN ('C:\\Windows\\System32\\rundll32.exe', 'C:\\\\Windows\\SysWOW64\\rundll32.exe')
Remediation Script (Bash)
This script assists administrators in verifying the PAN-OS version and checking for the exposure of the GlobalProtect service to the internet via the API.
#!/bin/bash
# PAN-OS GlobalProtect Hardening Check
# Requires 'curl' and API Key
# Configuration
FIREWALL_IP="<YOUR_PAN_IP_OR_HOSTNAME>"
API_KEY="<YOUR_API_KEY>"
EXPECTED_MIN_VERSION="10.2.0" # Update based on vendor advisory for fix
echo "[+] Checking PAN-OS Version for $FIREWALL_IP..."
# Get System Info
SYSTEM_INFO=$(curl -s -k "https://$FIREWALL_IP/api/?type=op&cmd=<show><system><info></info></system></show>&key=$API_KEY")
# Extract Version
CURRENT_VERSION=$(echo $SYSTEM_INFO | grep -oP '(?<=sw-version>)[^<]+')
if [ -z "$CURRENT_VERSION" ]; then
echo "[-] Failed to retrieve version. Check API Key and connectivity."
exit 1
fi
echo "[!] Current Version: $CURRENT_VERSION"
# Note: Logic to compare versions depends on specific release notes.
# This is a placeholder for the logic check.
# In a real IR scenario, verify specific build numbers against the advisory.
echo "[+] Checking Management Interface Access Profiles..."
MGMT_ACCESS=$(curl -s -k "https://$FIREWALL_IP/api/?type=config&action=get&xpath=/config/mgt-config&key=$API_KEY")
if echo "$MGMT_ACCESS" | grep -q "permit-any"; then
echo "[WARNING] Management interface might be exposed broadly. Review 'permit-any' rules."
else
echo "[+] Management interface restrictions appear active."
fi
echo "[ACTION ITEM] Verify if GlobalProtect is accessible from Untrust zone and patch immediately if version is vulnerable."
Remediation
- Patch Immediately: Apply the latest security updates provided by Palo Alto Networks for PAN-OS. Disregard standard maintenance windows; this requires emergency change management.
- Verify GlobalProtect Configuration: Ensure that GlobalProtect interfaces are not unnecessarily exposed to the entire internet. Utilize IP allow-listing for the GlobalProtect service if remote user mobility permits.
- Audit VPN Sessions: Conduct an immediate audit of all active GlobalProtect sessions. Terminate any sessions that cannot be immediately correlated to a known employee and device.
- Review Logs: Search firewall logs for authentication events originating from anomalous geolocations or indicating successful logins without corresponding MFA prompts (if MFA is enforced).
- Vendor Advisory: Consult the official Palo Alto Networks Security Advisories for the specific authentication bypass flaw and the minimum fixed software versions.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.