Qilin and Settra Ransomware Groups Still Exploiting Palo Alto VPN Flaw Patched in May 2025 — Detection and Remediation Guide

ReliaQuest has confirmed active exploitation of a Palo Alto Networks VPN vulnerability — patched back in May 2025 — by at least two encryption-based extortion operations: the Qilin ransomware-as-a-service group and Settra. That this flaw is still generating successful intrusions months after a vendor fix shipped tells us two things at once: ransomware initial-access brokers are continuing to weaponize it, and a meaningful population of PAN-OS edge devices remains unpatched.

If your organization runs PAN-OS firewalls with the GlobalProtect VPN gateway or portal enabled, treat this as an active incident-response trigger, not a routine patching reminder. Edge VPN devices sit at the exact intersection ransomware crews want: internet-facing, privileged, and frequently under-monitored. A successful exploit here hands operators an authenticated foothold on a device that can see, and often terminate, your most sensitive traffic.

Why This Matters Right Now

Qilin (also tracked as Agenda) is one of the most operationally mature RaaS programs active in 2025-2026, with affiliates hitting healthcare, manufacturing, and professional services globally. Settra is a smaller but aggressive encryption-focused extortion group. Both groups follow the same economic playbook: acquire access (often via edge-device exploitation or purchased VPN credentials), stage quietly, exfiltrate, then encrypt. When two separate groups converge on the same vulnerability, it usually means exploit tooling has matured and is being traded or rented broadly — exploitation is no longer artisanal, it is commoditized.

The uncomfortable truth from our IR casework at Security Arsenal: VPN appliances are frequently excluded from aggressive patch windows because "it handles remote access for 400 users." That calculus inverts when the device itself becomes the intrusion vector.

Technical Analysis

Affected Component

The vulnerability affects Palo Alto Networks PAN-OS with the GlobalProtect feature (gateway and/or portal) enabled. GlobalProtect terminates remote-access VPN sessions and exposes authentication and configuration endpoints directly to the internet — which is precisely the attack surface being probed and exploited. Devices running PAN-OS versions below the May 2025 maintenance releases should be considered vulnerable until verified otherwise.

Exploitation Mechanics (Defender's View)

Based on the observed campaign pattern, the attack chain looks like this:

1. Reconnaissance and fingerprinting — Scanning for internet-exposed GlobalProtect portals (/global-protect/, ssl-vpn paths), identifying PAN-OS version banners and behavioral fingerprints.
2. Exploitation of the unpatched flaw — Crafted requests against the GlobalProtect service on the management or VPN interface, achieving unauthorized access or code execution on the appliance without valid credentials.
3. Credential harvesting / session theft — Post-exploitation, operators dump cached VPN credentials, extract configuration, or hijack authenticated sessions. On PAN-OS, artifacts land in appliance logs (authd, sslvpn, gpsvc) and the device filesystem.
4. Internal pivot — Valid VPN access is used to authenticate as a legitimate user, blending into normal remote-access traffic. From there: RDP/SMB lateral movement, backup destruction, data staging to MEGA/rclone-style exfil channels, and finally mass encryption with Qilin or Settra payloads.

The critical defensive insight: the firewall is the entry point, but the damage happens downstream. Detection must therefore cover both the appliance and the post-authentication behavior of VPN-derived sessions.

Exploitation Status

• Confirmed active exploitation in the wild by Qilin and Settra operators, per ReliaQuest.
• Patch available since May 2025 via Palo Alto Networks security advisories. Continued exploitation months later indicates a large unpatched install base.
• Defenders should cross-reference the applicable Palo Alto Networks advisory at https://security.paloaltonetworks.com and check CISA's Known Exploited Vulnerabilities catalog for the relevant entry and any associated federal remediation deadline.

Detection & Response

Detection strategy has two layers: (1) evidence of exploitation or anomalous activity on the PAN-OS appliance itself, and (2) downstream behavior consistent with ransomware intrusion tradecraft following VPN access.

Sigma Rules

---
title: Suspicious Child Process Spawned by PAN-OS Services
description: Detects shell or scripting processes spawned under PAN-OS service accounts or directories, consistent with post-exploitation activity on a compromised Palo Alto firewall or commands executed after GlobalProtect exploitation. Fires on syslog-forwarded command logs from PAN-OS devices.
logsource:
  product: linux
  category: process_creation
  service: auditd
detection:
  selection_parent:
    ParentImage|contains:
      - '/usr/local/bin/gpsvc'
      - 'httpd'
      - 'nginx'
      - 'sslvpn'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/curl'
      - '/wget'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Palo Alto support-initiated diagnostic scripts (verify via change tickets)
level: high
references:
  - https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
author: Security Arsenal
date: 2026/01/15
---
title: Ransomware Staging Tools Executed Following VPN Session (Qilin/Settra TTPs)
description: Detects execution of tooling commonly used by Qilin and Settra affiliates for exfiltration staging and defense evasion shortly after VPN-based access, including rclone, mass vssadmin deletion, and remote archive utilities.
logsource:
  category: process_creation
  product: windows
detection:
  selection_exfil:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\megacmd.exe'
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - '\AppData\'
  selection_defense_evasion:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'bcdedit'
      - 'wbadmin delete'
      - 'recoveryenabled no'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup administrators running rclone to approved destinations; baseline destination flags and service accounts
level: high
references:
  - https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
author: Security Arsenal
date: 2026/01/15
---
title: GlobalProtect VPN Authentication from Impossible-Travel or Tor Exit Source
description: Detects successful GlobalProtect authentications originating from Tor exit nodes, anonymizing VPN services, or geographies inconsistent with the user's baseline — a common indicator of stolen VPN credentials being replayed after appliance exploitation.
logsource:
  product: paloalto
  service: globalprotect
detection:
  selection:
    EventType: 'globalprotect'
    Description|contains:
      - 'login succeeded'
      - 'authentication succeeded'
  filter_known_users:
    SourceUser|contains:
      - 'svc-'
  condition: selection and not filter_known_users
falsepositives:
  - Traveling executives; enrich with geo-velocity and threat-intel source IP matching before alerting
level: medium
references:
  - https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
author: Security Arsenal
date: 2026/01/15

KQL Hunt — Microsoft Sentinel / Defender

The following hunts PAN-OS syslog/CEF data ingested into Sentinel for GlobalProtect exploitation indicators and suspicious post-authentication behavior. Run over a 30-day lookback given the months-long exploitation window.

// Hunt 1: Anomalous GlobalProtect portal/gateway requests and auth anomalies
let lookback = 30d;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Palo Alto Networks"
| where DeviceProduct has_any ("GlobalProtect", "PAN-OS")
| where Message has_any ("login succeeded", "auth", "portal", "gateway")
| summarize AuthCount = count(), DistinctUsers = dcount(SourceUserID),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, SourceUserID, DestinationHostName
| where AuthCount > 50 or DistinctUsers > 10
| order by AuthCount desc;

// Hunt 2: VPN-authenticated source IPs later seen executing ransomware-staging behavior on endpoints
let vpnIPs =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where DeviceVendor =~ "Palo Alto Networks"
    | where Message has "login succeeded"
    | extend AssignedIP = tostring(extract(@"assigned IP[: ]+([0-9.]+)", 1, Message))
    | where isnotempty(AssignedIP)
    | summarize by AssignedIP;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("rclone.exe", "vssadmin.exe", "bcdedit.exe", "wbadmin.exe", "7z.exe")
   or ProcessCommandLine has_any ("delete shadows", "recoveryenabled no", "rclone copy", "rclone sync")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: PAN-OS device command execution indicative of post-exploitation shell activity
Syslog
| where TimeGenerated > ago(lookback)
| where Computer has_any ("pa-", "panorama", "fw-") or Facility =~ "local4"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "base64 -d", "chmod +x")
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc;

Velociraptor VQL — Endpoint Hunt for Post-Compromise Staging

If VPN access was abused, the intrusion tradecraft lands on internal endpoints. This artifact hunts for Qilin/Settra-style staging artifacts across your fleet.

-- Hunt for ransomware staging artifacts: exfil tools, shadow-copy tampering, and
-- recently dropped executables in user-writable directories
LET staging = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(rclone|vssadmin delete|bcdedit|wbadmin delete|recoveryenabled no|megacmd)'
   OR Exe =~ '(?i)(AppData\\\\Local\\\\Temp|Users\\\\Public|ProgramData)\\\\[^\\\\]+\.exe$'

LET dropped = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/Public/*.exe', accessor='ntfs')
WHERE Mtime > now() - 60 * 24 * 3600

SELECT * FROM staging
UNION ALL
SELECT NULL AS Pid, 'DROPPED_FILE' AS Name, FullPath AS CommandLine,
       '' AS Exe, '' AS Username, Mtime AS CreateTime
FROM dropped

Verification & Hardening Script (PAN-OS / Bash)

Use the following against your PAN-OS devices and management plane to verify patch level, inventory exposure, and audit for indicators of compromise. Run via an authenticated SSH session to the firewall CLI or Panorama.

#!/bin/bash
# panos-posture-check.sh — Verify PAN-OS patch posture and hunt for IoCs
# Usage: run commands against each firewall via: ssh admin@<fw> < cmd_list.txt

echo "=== 1. Current PAN-OS version (compare against May 2025+ maintenance release) ==="
show system info | match sw-version

echo "=== 2. GlobalProtect exposure check ==="
show running global-protect
show config running | match global-protect

echo "=== 3. Recent authentication anomalies (last 500 auth events) ==="
grep mp-log authd.log* | match "auth succeeded" | tail -500 | count
less mp-log authd.log

echo "=== 4. Hunt for suspicious shell/cron artifacts (post-exploitation persistence) ==="
show system files | match cron
debug cli on
tail lines 1000 mp-log gpsvc.log

echo "=== 5. Review GlobalProtect portal access logs for scanning/exploit patterns ==="
less mp-log sslvpn.log
grep mp-log sslvpn.log* | match "400\|500\|invalid"

echo "=== 6. Verify management interface ACLs — GP portal must NOT share untrusted mgmt ==="
show deviceconfig system permitted-ip

echo "=== 7. Confirm threat-prevention profiles are applied to inbound GP zone ==="
show zone-protection
show rulebase security rules

Remediation

1. Patch immediately. Upgrade every PAN-OS device running GlobalProtect to the fixed maintenance release identified in Palo Alto Networks' May 2025 security advisory (and apply all subsequent cumulative fixes — do not stop at the minimum). Pull the exact target versions from the official advisory at https://security.paloaltonetworks.com. Verify each device's running version post-upgrade; do not trust the deployment tool's report alone.
2. Assume compromise on unpatched devices. Any appliance that was internet-exposed and unpatched since May 2025 warrants an IR-level review: audit authd, sslvpn, and gpsvc logs for anomalous authentications, inspect for unauthorized admin accounts and unexpected configuration commits, and check for unfamiliar files or scheduled tasks on the appliance.
3. Rotate credentials en masse. If exploitation cannot be ruled out, force password resets for all VPN-authenticated accounts, revoke active GlobalProtect sessions, rotate certificates and pre-shared keys, and invalidate any cached SSO tokens.
4. Enforce MFA on GlobalProtect if not already in place. Credential theft loses most of its value when a second factor gates access. Confirm MFA covers the gateway and the portal.
5. Reduce exposure. Restrict GlobalProtect portal/gateway source IPs where business-tolerable, disable GlobalProtect on interfaces where it isn't required, and ensure the management interface is never reachable from untrusted networks.
6. Harden downstream. Because access leads to internal tradecraft, verify EDR coverage on systems reachable via VPN, alert on shadow-copy deletion and rclone-class tooling, and confirm backups are isolated and immutable against encryption-based extortion.
7. Monitor CISA KEV. If the underlying CVE is listed in the Known Exploited Vulnerabilities catalog, treat the associated remediation date as your internal deadline regardless of whether you're a federal agency — it reflects confirmed, weaponized exploitation.

Closing

Months-old VPN vulnerabilities remain live intrusion vectors precisely because edge devices are operationally painful to patch. Qilin and Settra are monetizing that hesitation. The patch is the floor, not the ceiling: pair it with credential rotation, appliance forensics, and downstream detection for ransomware staging. If you cannot confidently answer "was our firewall exploited before we patched," that uncertainty is itself a finding — treat it like one.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub