Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations utilizing Palo Alto Networks PAN-OS or Prisma Access
Incident: Active exploitation of CVE-2026-0257 to bypass MFA and deploy ransomware.
Impact: Full domain compromise and data encryption through virtualization layer pivots and backup destruction.
Attacker: Qilin, INC, and Settra ransomware groups
Analysis: Attackers are weaponizing CVE-2026-0257 to establish unauthorized VPN sessions, bypassing multi-factor authentication for initial access. A significant tactical evolution involves pivoting from the VPN gateway directly to the virtualization layer, where they disable ESXi security controls to dump credentials offline. This method effectively circumvents guest-level EDR and is often paired with attacks on Veeam backup systems to ensure maximum impact.
Recommendations: Update PAN-OS and Prisma Access to the latest patched versions immediately.; Monitor vCenter and ESXi hypervisors for unauthorized configuration changes or access.; Restrict management access to virtualization layers using strict network segmentation.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-10-23 14:24 UTC
Large-scale exploitation of enterprise firewalls and VPNs leading to the theft of over 70,000 credentials. Widespread unauthorized network access and data exfiltration across multiple global sectors. The threat actor k0t leverages a mix of N-day exploits and brute-force attacks to compromise Fortinet and Palo Alto edge devices. Once initial access is gained, the actor deploys legitimate remote management tools and the AdaptixC2 framework to maintain persistence and harvest Active Directory credentials. This operation appears to function as an initial access brokerage service, likely feeding victims to ransomware groups such as Qilin.
Corroborating source: thehackernews.com