CVE-2026-0257 Exploitation and the Path to Qilin Ransomware

Summary

Threat actors are exploiting a critical authentication bypass flaw in Palo Alto Networks GlobalProtect to obtain initial access. After entering the environment, the attackers deploy Qilin ransomware, often after stealing credentials and exfiltrating data. The resulting intrusions range from fast-moving encryption events to more complex double-extortion operations.

Investigation

Arctic Wolf Labs investigated several intrusions in June 2026 tied to exploitation of CVE-2026-0257. The investigation showed a progression from perimeter-level compromise to ransomware encryption across the broader domain. Analysts also observed recurring staging patterns and use of different remote access tools by separate affiliates.

Mitigation

Organizations should immediately patch CVE-2026-0257 on all affected PAN-OS and Prisma Access systems. Strong monitoring of the C:\PerfLogs directory and tighter restrictions on administrative share access are also recommended. Disabling authentication override features can further reduce exposure and limit abuse paths.

Response

If this activity is detected, rotate all domain administrator, service, and KRBTGT credentials without delay. Terminate all active GlobalProtect VPN sessions to invalidate unauthorized access. Investigators should also conduct a thorough review for possible data exfiltration to cloud platforms such as MEGA.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access to a workstation and has successfully executed a payload. To prevent detection of their lateral movement and privilege escalation, they execute a “one-liner” PowerShell script. The script’s goal is to identify every log name present on the system and programmatically call the ClearLog method for each one, effectively wiping the forensic history of the machine.

• Regression Test Script:

  # Simulation of the exact command targeted by the Sigma rule
  $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ($l in $logs | Sort | Get-Unique) { [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l) }

• Cleanup Commands:

  # Note: Since the logs were cleared, the primary cleanup is restoring the system state.
  # In a real lab, you would restore from a snapshot. 
  # To prevent further issues, ensure you restart the Windows Event Log service if it becomes unstable.
  Restart-Service EventLog -Force