Ransomware groups exploit patched flaw in Palo Alto VPN software

Multiple ransomware groups, including Qilin and Inc, have been exploiting a security flaw in Palo Alto Networks’ PAN-OS since at least early June, according to the company’s Unit 42 incident response team. The vulnerability can let attackers bypass security restrictions and multi-factor authentication to establish unauthorised VPN access, putting organisations across many sectors at risk.

After gaining access, attackers have moved through networks, stolen credentials and data, and deployed ransomware. Unit 42 also described a case in which intruders reached VMware management systems and used a custom tool to extract credentials from a virtual disk, potentially evading endpoint security tools. Palo Alto Networks patched the flaw on 13 May, but the number of affected organisations is not known; researchers reported successful exploitation dating back to at least 17 May.