Search — “CVE-2026-0257”

Group-IB and NyxLab attribute a large campaign to the actor k0t, who reportedly scans for exposed Fortinet FortiGate and Palo Alto GlobalProtect devices, exploits CVE-2025-64446 and CVE-2026-0257 or brute-forces credentials, and establishes an OpenConnect VPN foothold. Sources describe persistence via MeshCentral, Atera, Teramind, AnyDesk-like tools and AdaptixC2, Rclone exfiltration to Wasabi and MEGA, and AD enumeration with Impacket and Mimikatz. Hunters should look for OpenConnect sessions from edge devices, unexpected RMM agents, and Rclone or AdaptixC2 activity; the sources say more than 70,000 credentials were identified, and the actor is assessed as a possible access broker for Qilin and The Gentlemen.

Unit 42 reports that ransomware operators, including Qilin (Spikey Scorpius), Inc (Tarnished Scorpius) and Settra-linked actors, are exploiting the KEV-listed GlobalProtect portal/gateway authentication bypass CVE-2026-0257. They bypass MFA to establish VPN sessions, run reconnaissance with RMM tools, move laterally over RDP/SMB, and pivot to vCenter/ESXi. On ESXi they disable execInstalledOnly and dump credentials offline from a domain controller VMDK. Some actors chain the access with the Veeam exploit CVE-2023-27532. Hunters should check GlobalProtect logs for gateway-connected events from the listed IPs, the fake host IDs/MACs and the PoC client values. They should also look for VPN-to-vCenter access and ESXi security-setting changes.