Edge VPN Ransomware Wave: Qilin & INC Ransom Weaponize GlobalProtect (CVE-2026-0257), Broker "k0t" & Ivanti Zero-Day (CVE-2026-104935)
CVE-2026-0257 & CVE-2026-104935 (CWE-287 (Improper Authentication) & CWE-290 (Authentication Bypass by Spoofing))
Severity: HIGH / CRITICAL RANSOMWARE VECTOR (CVSS 7.8 – 8.6)
Threat Actor: Qilin (Spikey Scorpius), INC Ransom (Tarnished Scorpius), IAB "k0t" (CryptoFeel) & UTA0576
Status: Active Ransomware & Zero-Day Exploitation in the Wild; CVE-2026-104935 Added to CISA KEV
Affected Systems: Palo Alto Networks PAN-OS GlobalProtect Portal/Gateway | Ivanti Connect Secure (< 25.1.3.0 / 22.8R2.5)
Fixed In: Patched PAN-OS Releases (+ Auth Override Hardening) | Ivanti Connect Secure 25.1.3.0+
A coordinated wave of threat intelligence advisories published entering the weekend by Palo Alto Networks Unit 42, ReliaQuest, Arctic Wolf, Group-IB, and Volexity exposed a dangerous escalation in enterprise perimeter intrusions. Two of the most aggressive Ransomware-as-a-Service (RaaS) syndicates—Qilin (tracked by Unit 42 as Spikey Scorpius) and INC Ransom (Tarnished Scorpius)—are systematically weaponizing CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks GlobalProtect VPN portals and gateways, fed by a sprawling initial access broker operation tracked as "k0t" (CryptoFeel). Even more concerning is what happens after initial access: operators are bypassing in-guest Endpoint Detection and Response (EDR) sensors entirely by pivoting to VMware ESXi hypervisors and extracting Domain Controller .vmdk virtual disks offline. Meanwhile, Volexity and CISA alerted defenders to active zero-day exploitation of CVE-2026-104935 (CVSS 8.6) in Ivanti Connect Secure by threat cluster UTA0576.
1. The Perimeter Breach: GlobalProtect CVE-2026-0257 & Initial Access Broker "k0t"
Originally disclosed in PAN-OS earlier in 2026, CVE-2026-0257 affects GlobalProtect portal and gateway configurations—particularly environments utilizing or misconfiguring authentication override cookies and internal gateway session handoffs. By supplying a crafted authentication bypass request, an unauthenticated remote attacker can establish a valid GlobalProtect VPN tunnel without completing multi-factor authentication (MFA).
Why has CVE-2026-0257 become a favorite of ransomware affiliates in October 2026?
- Blending Into Trusted VPN DHCP Pools: Because the unauthorized session terminates natively on the GlobalProtect gateway interface, all subsequent lateral movement traffic originates from an internal VPN client IP address—blending seamlessly into legitimate remote-worker telemetry.
- Industrialized Harvesting by "k0t": Research from Group-IB and NyxLab revealed that the threat actor k0t (also known as CryptoFeel or Member19) has used internet intelligence platforms (FOFA and ZoomEye) to fingerprint thousands of exposed GlobalProtect, FortiGate, and FortiWeb appliances, harvesting tens of thousands of VPN credentials and handing pre-established perimeter footholds directly to Qilin and INC Ransom affiliates.
2. How Qilin & INC Ransom Evade Guest EDR via Offline ESXi VMDK Extraction
Once inside the internal network via GlobalProtect, Qilin and INC Ransom operators execute initial discovery using Cobalt Strike, SharpHound, and BloodHound. However, modern enterprise Domain Controllers (DCs) are heavily instrumented with kernel-level EDR agents that immediately block or alert on LSASS memory dumping (mimikatz) or Volume Shadow Copy extraction (ntdsutil / vssadmin).
To defeat guest EDR completely, Unit 42 and Arctic Wolf documented Qilin and INC operators executing a hypervisor-layer credential extraction technique:
- Attackers compromise VMware vCenter or ESXi host management interfaces (often via AD-integrated vSphere admin groups or unpatched ESXi management ports).
- Instead of touching the running Windows Domain Controller OS, the attacker accesses the underlying ESXi datastore (
/vmfs/volumes/<datastore>/<DC-VM>/) and creates a brief snapshot or copies the secondary/snapshot.vmdkvirtual disk descriptor and delta extent out-of-band. - Mounting the copied VMDK file offline inside an attacker-controlled Linux VM or appliance, they extract
C:WindowsNTDSNTDS.ditand theSYSTEMregistry hive directly from the raw NTFS filesystem blocks. - Running
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCALoffline yields every Domain Admin NTLM hash and Kerberoskrbtgtkey in the enterprise—with zero process creation, zero file reads, and zero EDR telemetry inside the Windows Domain Controller guest!
3. Ivanti Connect Secure Zero-Day (CVE-2026-104935) Exploited by UTA0576
Adding to the VPN perimeter crisis, Ivanti, Volexity, and CISA confirmed active in-the-wild zero-day exploitation of CVE-2026-104935 (CVSS 8.6, CWE-290 Authentication Bypass by Spoofing) affecting Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (and legacy 22.8 bridge builds prior to 22.8R2.5). Tracked by Volexity as UTA0576, the threat actor chained this spoofing bypass with a local privilege escalation primitive to achieve unauthenticated root command execution on ICS appliances—immediately pivoting into internal networks to dump Active Directory structures, Local Administrator Password Solution (LAPS) passwords, and BitLocker recovery keys.
Detection Telemetry & Threat Hunting
# 1. PAN-OS GlobalProtect Log Hunt: Detect Gateway connections lacking a preceding Portal auth event
index=pan_logs sourcetype="pan:system" subtype="globalprotect"
| stats count values(event_id) as events values(auth_method) as auth_methods min(_time) as first_seen max(_time) as last_seen by src_ip, user, tunnel_ip
| where mvfind(events, "gateway-connected") >= 0 AND isnull(mvfind(events, "portal-auth"))
# 2. VMware ESXi / vCenter Syslog Hunt: Detect anomalous datastore downloads or VMDK copies of Domain Controllers
index=vmware_esxi (sourcetype="vmw-syslog" OR process="hostd" OR process="vpxa")
| search ("*.vmdk" OR "*.vmsn" OR "NFC" OR "/folder/") AND ("DC01" OR "DC02" OR "DomainController")
| table _time, host, user, src_ip, messageRemediation & Hardening Directives
- Patch PAN-OS & Harden GlobalProtect Auth Override: Ensure all PAN-OS firewalls are running versions patched against CVE-2026-0257. Disable Generate Cookie for Authentication Override and Accept Cookie for Authentication Override unless strictly required; if enabled, use a dedicated, isolated certificate solely for override cookies.
- Upgrade Ivanti Connect Secure Immediately: Patch all Ivanti Connect Secure appliances to version 25.1.3.0 (or 22.8R2.5 for bridge deployments), run the external Integrity Checker Tool (ICT), and force-revoke all active VPN sessions.
- Isolate ESXi & Enable vSphere VM Encryption: Remove ESXi hosts and vCenter from Active Directory authentication domains, enforce hardware MFA via an isolated identity provider, and enable vSphere VM Encryption on Domain Controller VMs so raw VMDK files cannot be parsed offline without KMS keys.
