Ransomware crews turn unpatched VPN access into network entry
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, October 21st, 2026.
Ransomware groups are exploiting a patched authentication bypass in Palo Alto Networks products to establish unauthorized V P N sessions. Activity linked to Qilin, INC and other groups has continued for months after the vulnerability was disclosed. Because the access appears to come through an internal V P N, malicious sessions may initially look like legitimate remote work. Investigated attacks have included credential theft, lateral movement, data theft, ransomware and attempts to reach VMware infrastructure.
Organizations in education, finance, healthcare, IT, manufacturing and government have been exposed. Attackers can quickly turn V P N access into persistent control, while targeting virtualization systems may help them avoid some endpoint defenses. For leaders, a delayed patch on an internet-facing device can become a wider business interruption and extortion risk. For defenders, successful V P N authentication should not end the investigation when a session behaves abnormally.
Organizations should patch every affected Palo Alto Networks system, review V P N sessions for unusual origins or behavior, and investigate related identity, virtualization, and data access.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
