Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks

Ransomware operators are exploiting a Palo Alto Networks GlobalProtect VPN flaw to bypass multi-factor authentication and enter corporate networks. In one investigated case, attackers reached VMware management systems and stole credentials directly from a domain controller’s virtual disk, avoiding security tools running inside the virtual machine.

Palo Alto Networks Unit 42 detailed the activity in an October 19 threat brief update. Researchers linked exploitation of CVE-2026-0257 to Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Separate public reporting connected exploitation to operators using Settra ransomware.

Investigations ongoing since early June have covered healthcare, education, financial services, manufacturing, government, energy, and other sectors. The latest findings show how unauthorized VPN access can develop into credential theft, data theft, and ransomware deployment.

GlobalProtect Flaw Bypasses MFA

The vulnerability affects GlobalProtect portals and gateways in certain PAN-OS and Prisma Access deployments. Exposure requires authentication override cookies to be enabled alongside a vulnerable certificate setup. Palo Alto Networks rates the flaw High, with a CVSS score of 7.8 and its highest suggested response urgency. Panorama and Cloud NGFW are not affected.

Authentication override cookies let previously authenticated users reconnect without repeating the full login process. According to Rapid7’s technical analysis, vulnerable devices decrypt these cookies but do not properly verify that a trusted system created them.

If the cookie certificate is reused for a publicly exposed service, attackers can obtain its public key and forge a cookie. The gateway may accept that cookie as proof of authentication, allowing a VPN connection without the normal login and MFA checks. Cybersecurity News previously covered this GlobalProtect authentication bypass.

After establishing access, attackers use remote monitoring and management tools to explore internal networks. They move between systems through Remote Desktop Protocol and Server Message Block, then prepare tools for credential harvesting, data theft, and ransomware deployment.

The most notable case involved a move from the compromised VPN gateway to VMware’s vCenter management appliance. Attackers then disabled the execInstalledOnly security control on ESXi hosts and used a custom tool to extract credentials offline from a domain controller’s VMDK virtual disk. Unit 42 did not name the tool or provide its implementation details.

Reading credentials directly from the disk bypasses endpoint detection and response controls inside the affected virtual machine. The approach targets the infrastructure beneath the operating system rather than relying on a credential-stealing program running within it. Cybersecurity News has also reported on VMware attacks involving detached domain controller disks.

Unit 42 also observed attackers combining this initial access with tools targeting Veeam backup infrastructure through CVE-2023-27532. That separate flaw can expose encrypted credentials stored in the backup configuration database, potentially opening access to backup hosts.

Defenders should examine GlobalProtect logs for successful gateway-connected events linked to suspicious sources and client details. Reported indicators include 104.207.144[.]154, 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host IDs aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. Earlier monitoring found that many probes did not establish full VPN sessions, making connection events important for investigation.

Organizations should follow the Palo Alto Networks advisory and upgrade every affected portal and gateway. Temporary mitigations include disabling authentication override or generating a new certificate dedicated exclusively to override cookies.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks appeared first on Cyber Security News.