Vulnerabilities

Settra joins Qilin in exploiting GlobalProtect VPN bypass flaw

ReliaQuest says Settra ransomware has joined Qilin in exploiting GlobalProtect flaw CVE-2026-0257. Patch, end VPN sessions, then hunt.

Network graphic with headline: Second ransomware gang exploits GlobalProtect flaw

ReliaQuest says the Settra ransomware operation has joined Qilin in exploiting CVE-2026-0257, the GlobalProtect authentication bypass Palo Alto Networks patched in May. Organisations that patched late may already have an intruder on their VPN, so applying the update is only the first step.

What happened

ReliaQuest’s threat research team posted an update on 9 October saying it is still seeing active exploitation of CVE-2026-0257. The flaw lets attackers skip authentication on GlobalProtect portals and gateways running Palo Alto Networks PAN-OS, and it also affects Prisma Access. Cyber Security News and Hacks.gr reported the update on 11 October. According to ReliaQuest, several groups are using the bug to open VPN sessions they are not entitled to, among them the Qilin and Settra ransomware operations. Its analysts also observed Cobalt Strike, BloodHound and SharpHound in related activity. It expects exploitation to stay “highly likely” for the next three months, as ransomware crews and initial access brokers go after unpatched gateways.

Palo Alto Networks published its advisory on 13 May 2026. Rapid7 reported exploitation against customers from 17 May, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 May. In July, Arctic Wolf Labs tied a series of June intrusions to Qilin ransomware deployments, all of which began with this bug. What is new is a second named ransomware group, which suggests the exploit is no longer confined to a single ransomware operation.

Writing on 11 October about research by Cynet, TechSpective says Settra first appeared in June 2026 and has named somewhere between 50 and more than 70 organisations on its leak site. Cynet’s description of its encryptor comes from one sample recovered during one incident, so it should be treated as one vendor’s analysis rather than an established profile.

The technical picture

CVE-2026-0257 carries a CVSS 4.0 score of 7.8, but Palo Alto rates its response urgency at the highest level. The weakness is in how GlobalProtect handles authentication override cookies. These are tokens that let a user who has already signed in to the portal reach a gateway without typing their credentials again. Where the cookies are not properly validated, an attacker with no credentials can establish a VPN session.

Not every deployment is exposed. Two conditions must both be met: authentication override cookies are enabled on the portal or gateway, and a particular certificate configuration is in place. Vulnerable branches are PAN-OS 10.2, 11.1, 11.2 and 12.1, plus Prisma Access 10.2 and 11.2, while Panorama and Cloud NGFW are out of scope. Unsupported older releases must move to a supported fixed version. Fixed releases include 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6, and there are hotfix builds for earlier maintenance trains. Match your exact build against Palo Alto’s table, not just the major version.

There are operational catches. The fix changes how cookies are generated, so users must authenticate once more after upgrading, and every portal and gateway that issues or accepts these cookies needs the update to avoid compatibility failures, including on-premises firewalls in hybrid Prisma Access estates. The advisory includes a temporary way to relax strict cookie validation during a phased rollout, but administrators must turn strict validation back on once all components are patched. Leaving it relaxed undermines the fix.

The tooling ReliaQuest reports is familiar: BloodHound and its SharpHound collector map Active Directory paths to privileged accounts, while Cobalt Strike handles command and control. Arctic Wolf’s earlier Qilin cases included credential dumping, theft of the Active Directory database, remote access tools and deliberate log clearing before encryption.

Timeline of CVE-2026-0257 from Palo Alto's May advisory to ReliaQuest's October warning naming Settra and Qilin

Why it matters for UK organisations

GlobalProtect is widely deployed, including in the UK. In July, Shadowserver was tracking more than 167,000 GlobalProtect instances reachable from the internet worldwide, though that figure does not show how many were vulnerable. UK organisations already know Qilin: BleepingComputer lists Synnovis, the pathology services provider, among its victims, although that June 2024 attack is unrelated to this flaw.

The bigger concern is detection. An attacker arriving through your own VPN looks like a remote worker. ReliaQuest warns such sessions can go unnoticed until credential theft or encryption is under way. Many UK organisations have rightly prioritised MFA on their VPN, but MFA does not help when the authentication step is bypassed altogether.

Timing also matters for regulatory exposure. Under UK GDPR, an organisation that loses personal data through a flaw patched five months earlier is likely to struggle to show the ICO that its technical measures were appropriate. Managed service providers that run these gateways for clients should expect the same scrutiny, and the Cyber Security and Resilience Bill is set to bring more of them into scope.

Expert view

In my experience, VPN concentrators are among the least monitored devices on a network relative to the access they grant. Teams patch them, often late, and assume the job is done. If an attacker opened a session in June and you patched in September, the patch closed the door behind them. It did not remove them.

When we test remote access estates, authentication override cookies are often switched on for convenience and then forgotten. They are also frequently signed with a certificate that is reused elsewhere. Palo Alto’s advice to use a dedicated certificate just for these cookies is good practice whatever the status of this CVE.

Settra’s arrival matters strategically. Once a reliable exploit escapes one affiliate programme, brokers sell the footholds it produces, and access taken in one quarter is cashed in by a buyer the next. That makes ReliaQuest’s three-month outlook plausible, and it is why organisations that patched long ago should still review their logs.

What to do now

  1. Confirm your exposure. List every portal and gateway, check whether authentication override cookies are enabled, and compare each exact build with Palo Alto’s fixed-version table. This falls under the Cyber Essentials security update management control.
  2. Patch everything together. Upgrade all portals, gateways and hybrid Prisma Access firewalls, then re-enable strict cookie validation once the rollout is complete.
  3. Disable or isolate the cookies. Turn off authentication override where it is not needed. Where it is, issue a new certificate used only for those cookies (secure configuration).
  4. Evict existing sessions. After patching, end every active GlobalProtect session and make users authenticate again. Patching on its own does not remove an attacker who is already connected.
  5. Hunt retrospectively. Go back through GlobalProtect logs to May for unexpected sessions, unfamiliar client hostnames (ReliaQuest suggests “kali” as a lead, not proof) and logins at odd times. Check them against the IP indicators ReliaQuest published.
  6. Look for the next stage. Search endpoints and domain controllers for Cobalt Strike beacons, SharpHound collection, LSASS access and cleared event logs. If you find any of these, treat it as a live incident: rotate privileged and service credentials, including KRBTGT.
  7. Protect recovery. Keep backups offline under separate credentials, and forward logs off hosts in real time, because both Qilin and Settra have been reported wiping local evidence.

Bottom line

CVE-2026-0257 is no longer one gang’s tool. With Settra now named alongside Qilin and initial access brokers also hunting unpatched gateways, any GlobalProtect estate that ran vulnerable code since May should be treated as possibly compromised until the logs show otherwise. Patch, end active sessions, then hunt.

Sources

Related Posts