Ransomware groups exploit PAN-OS GlobalProtect auth bypass

🚨 ACTIVE EXPLOITATION

• Ransomware groups Qilin and Inc actively exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257 CVE-2026-0257
  Ransomware operators including Qilin and Inc are actively exploiting the PAN-OS GlobalProtect authentication bypass CVE-2026-0257 to gain VPN access and deploy ransomware.
  • Affects Palo Alto Networks PAN-OS firewalls and Prisma Access with GlobalProtect portal/gateway configured with authentication override cookies and a specific certificate configuration; Panorama and Cloud NGFW are not impacted.
  • The flaw (CWE-565, reliance on cookies without validation) lets unauthenticated attackers bypass security controls and establish unauthorized VPN connections; affected versions include PAN-OS 10.2, 11.1, 11.2, and 12.1 prior to fixed hotfixes.
  • Ransomware groups Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and actors using Settra ransomware exploit it for initial access, bypassing MFA to establish VPN sessions.
  • Post-exploitation includes reconnaissance with dual-use RMM tools, lateral movement via RDP and SMB, credential harvesting, and in one case pivoting to vCenter to disable ESXi execInstalledOnly and dump credentials from a domain controller's VMDK offline, bypassing EDR.
  • IOCs include source IPs 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119/120/125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, 202.144.192[.]47, and suspicious host IDs like aa:bb:cc:dd:ee:ff and WINDOWS-LAPTOP-001; the CVE was added to CISA's KEV catalog on May 13, 2026.
  Sources 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42

💥 BREACHES & INCIDENTS

• Hackers hijacked AOMEI Backupper update servers in 5-10 minute bursts to deliver SHINYROAD backdoor
  A threat actor tracked as UNC7017 briefly tampered with AOMEI Backupper's update server configuration files to deliver the CROSSROAD downloader and SHINYROAD backdoor to machines checking for updates.
  • Affects users of AOMEI Backupper Windows backup software (lab examined version 8.3.0); AOMEI's AnyViewer remote-desktop tool uses the same update flow.
  • Attackers modified two server-side config files — down_html.ini and Notifycfg.ini — during three short windows (May 28, July 16, July 20, 2026), altering checksums so malicious archives passed verification; no software vulnerability was exploited.
  • CROSSROAD downloader performed reconnaissance, installed a signed Radmin copy that loads a malicious DLL and the SHINYROAD backdoor, and persisted via a scheduled task; it self-deleted and halted in China and on some security agents.
  • A July 20 variant used an invisible WebDAV popup to steal NetNTLMv2 authentication hashes without executing code.
  • Affected organizations span 11 countries including the US, Australia, India, Spain, and Switzerland, in IT services, telecom, and higher education; IOCs include 8.210.84[.]56 and serv.oss-cn-hongkong[.]aliyuncs.com.
  Sources 📄 Source: cloud.google.com · 📎 Coverage: thehackernews.com · 👁 via BleepingComputer

🕵️ RESEARCH & DEEP DIVES

• Researchers Infiltrate Microsoft Tech Support Scam Operation Run via Help TDS
  Infoblox researchers gained inside access to Help TDS, a malicious traffic distribution system run by a Russian affiliate network that redirects victims to Microsoft-impersonating tech support scams.

  • Affects Windows users targeted via hijacked web traffic, including traffic from known malware operations like Balada Injector and DollyWay.
  • Help TDS, active since 2017, is operated by Hotejka, a Russian-language advertising affiliate network, and routes traffic for more than a dozen criminal affiliates while abusing thousands of Cloudflare links.
  • Victims are fingerprinted and shown fake Windows update and Windows Security Center warnings with a phone number and voice-over urging them to call 'Microsoft support'.
  • Call center operators pose as Microsoft staff and direct victims to download UltraViewer remote desktop software, enabling repeated exploitation and living-off-the-land malware operations.
  • Infoblox researchers obtained access to the Hotejka affiliate panel and recorded a 13-minute call with the scam call center; the platform filters out sandboxes and protected systems.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• fake-cloudflare-captcha-wordpress-malware — mysites.guru (discovered)

📋 ADVISORIES

• 📄 Source for Nikkei discloses third data breach in a month, exposing 1.83 million records — nikkei.co.jp

🔓 CVEs & KEV

• CVE-2026-112900 — python-pillow Pillow — CVSS 9.2 — Pillow: Argument Injection in Ghostscript call, potentially leading into RCEP...

• CVE-2026-112896 — python-pillow Pillow — CVSS 8.8 — Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds...

• CVE-2026-112897 — python-pillow Pillow — CVSS 8.7 — Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stri...

• CVE-2026-112895 — python-pillow Pillow — CVSS 8.7 — Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incompl...

• CVE-2026-112894 — python-pillow Pillow — CVSS 8.7 — Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)Pillow i...

• CVE-2026-112893 — python-pillow Pillow — CVSS 8.2 — Pillow: Invalid free in FreeType glyph rendering when a stroker is activePill...

• CVE-2026-112901 — python-pillow Pillow — CVSS 6.9 — Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minute...

• CVE-2026-112898 — python-pillow Pillow — CVSS 6.9 — Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryP...