Is your PHP version at risk of PHP2Shell RCE?
Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass (CVE-2026-0257) for Initial Access
Indicators of Compromise
No domains found for this campaign
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
Remediation/Detections
Priority Remediation Actions (per Arctic Wolf Labs guidance):
Patch CVE-2026-0257 immediately on all internet-facing PAN-OS appliances (affected: PAN-OS 12.1, 11.2, 11.1, 10.2, and Prisma Access); terminate all active GlobalProtect sessions after patching.
Review VPN authentication logs for sessions from hosting-provider/VPS IP ranges, hosts self-identifying as "kali", or default Windows hostnames (DESKTOP-[ALPHANUMERIC]).
Rotate all credentials if exploitation is suspected, including domain admin accounts, the KRBTGT account (twice), service accounts, and cloud storage credentials (MEGA, ProtonDrive, FileZilla).
Monitor and restrict execution from C:\PerfLogs\, the directory consistently used for ransomware staging across observed intrusions.
Alert on administrative-share write activity, PSEXESVC.exe creation where PsExec is not sanctioned, and Windows Security Event ID 1102 (audit log cleared).
Forward Windows Event Logs to a centralized SIEM in real time to preserve forensic evidence against the enterprise-wide log-clearing routine observed in this campaign.
Detection strategies below are sourced directly from MITRE ATT&CK's STIX "detects" relationships for each technique.
ATT&CK ID | Technique | Tactic | Detection ID | Detection Strategy |
Exploit Public-Facing Application | Initial Access | Exploit Public-Facing Application — multi-signal correlation (request -> error -> post-exploit process/egress) | ||
Valid Accounts: Domain Accounts | Stealth | Abuse of Domain Accounts | ||
Registry Run Keys / Startup Folder | Persistence | Detect Registry and Startup Folder Persistence (Windows) | ||
Scheduled Task | Execution | Detection of Suspicious Scheduled Task Creation and Execution on Windows | ||
Remote Access Tools | Command and Control | Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic) | ||
LSASS Memory | Credential Access | Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence | ||
NTDS | Credential Access | Detection of NTDS.dit Credential Dumping from Domain Controllers | ||
Network Service Discovery | Discovery | Behavioral Detection Strategy for Network Service Discovery Across Platforms | ||
Remote System Discovery | Discovery | Detection Strategy for Remote System Enumeration Behavior | ||
SMB/Windows Admin Shares | Lateral Movement | Multi-Event Detection for SMB Admin Share Lateral Movement | ||
Remote Desktop Protocol | Lateral Movement | Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity | ||
Lateral Tool Transfer | Lateral Movement | Detection Strategy for Lateral Tool Transfer across OS platforms | ||
Clear Windows Event Logs | Defense Impairment | Detection of Event Log Clearing on Windows via Behavioral Chain | ||
Disable or Modify Tools | Defense Impairment | Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms | ||
Exfiltration to Cloud Storage | Exfiltration | Detection Strategy for Exfiltration to Cloud Storage | ||
Data Encrypted for Impact | Impact | Detection of Multi-Platform File Encryption for Impact | ||
PowerShell | Execution | Abuse of PowerShell for Arbitrary Execution | ||
Windows Command Shell | Execution | Behavioral Detection of Windows Command Shell Execution |