SOCRadar Threat Research Unit (STRU; published 24 September 2026; Cybersecurity News amplified 28 Sep) documents Operation Master (April–mid-September 2026): a multi-tier intrusion and monetization pipeline that exploited Palo Alto Networks PAN-OS GlobalProtect authentication bypass CVE-2026-0257 to establish unauthorized VPN sessions on seven gateways in four countries, combined with web-app/SQL attacks (incl. xp_cmdshell), AdaptixC2 on at least two Windows servers, DNS tunneling / rclone exfil, and an automated invoice-fraud panel. Fraud telemetry cited: 2,468,335 emails and 1,487,294 SMS by 16 Sep; 622,666 personalized links; targeting skewed to Brazilian payment/PIX workflows; energy-sector data also sold under forum persona “masterblack”.

Recon: ~277.5M address scans → 81 high-value orgs; 9+ databases stolen. Vendor PSIRT CVE-2026-0257 (published 13 May 2026, updated 3 Jun): auth bypass on GlobalProtect portal/gateway when authentication-override cookies are enabled with a specific certificate configuration; Panorama and Cloud NGFW not impacted; Exploit Maturity ATTACKED; limited exploit attempts on unpatched devices without mitigations. Primary: Palo Alto PSIRT; campaign: SOCRadar; wire: CSN.

UPDATE (11 Oct): ReliaQuest says several ransomware groups, including Qilin and Settra, are now using CVE-2026-0257 to open unauthorised GlobalProtect VPN sessions and walk into internal networks through the victim's own remote-access service, where the traffic looks like normal remote work. It also saw follow-on use of Cobalt Strike, BloodHound and SharpHound, and assesses that exploitation is highly likely to continue over the next three months as ransomware crews and access brokers chase unpatched gateways.

Arctic Wolf had already tied June 2026 intrusions that ended in Qilin ransomware to this flaw (report of 20 July), with VPN sessions coming from machines named "kali". Settra is the newly named group. What to do: patch every internal and external GlobalProtect portal and gateway that issues or accepts authentication-override cookies (hybrid Prisma Access sites must also upgrade their on-premises firewalls), then end all active GlobalProtect sessions, because patching does not remove access an attacker already has.

Review unexpected VPN connections, including hostnames such as "kali" (a lead to check, not proof on its own), and rotate credentials, including the Active Directory KRBTGT account, if anything suspicious turns up. Wire: Cyber Security News (11 Oct, citing ReliaQuest); earlier: Arctic Wolf Labs.

UPDATE (Unit 42 threat brief updated 19 Oct, 4:00 pm PT, 20 Oct 07:00 Perth): Palo Alto Networks' Unit 42 says it continues to see attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (INC), and notes public reporting tying Settra ransomware operators to it. Its investigations, running since early June 2026, span education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.

After opening a VPN session that sidesteps MFA, the attackers typically run reconnaissance with dual-use remote monitoring and management (RMM) tools, move laterally over RDP and SMB, and stage tools for credential theft, data theft and ransomware. Unit 42 calls the direct pivot to the virtualisation layer the most significant change: in one case the attackers went from the VPN gateway to the vCenter management appliance, turned off the execInstalledOnly protection on ESXi hosts, and used a custom tool to dump credentials offline from a domain controller's virtual disk (VMDK), which bypasses endpoint detection inside the guest.

It has also seen the access chained with exploits for Veeam Backup & Replication CVE-2023-27532. Unit 42 lists IP addresses, host IDs and device names (such as aa:bb:cc:dd:ee:ff, DESKTOP-GP01 and GP-CLIENT) to search for in GlobalProtect logs. Wire: The Hacker News (20 Oct).