Qilin and INC Exploited a Patched Palo Alto VPN Bypass for Four Months. ConnectWise Shows Where the Same Trust Failure Went Next.

Ransomware operators have spent roughly four months monetizing a critical authentication bypass in Palo Alto Networks GlobalProtect VPN software. While the vulnerability was patched in May, Unit 42 reported on October 19 that the threat actors behind the Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, or INC, ransomware groups were actively exploiting the flaw to gain initial network access. Public reporting on the extent of this campaign emerged on October 21. The vulnerability tracked as CVE-2026-0257 represents the VPN-perimeter instance of the trust-through-defaults pattern, a trend detailed in recent coverage of nine identity-layer bypasses and the BeyondTrust Remote Support incident. The migration of this pattern into the core of managed service provider infrastructure is specifically evidenced by the ConnectWise incident .

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.