Search — “Settra”

Unit 42 reports that ransomware operators, including Qilin (Spikey Scorpius), Inc (Tarnished Scorpius) and Settra-linked actors, are exploiting the KEV-listed GlobalProtect portal/gateway authentication bypass CVE-2026-0257. They bypass MFA to establish VPN sessions, run reconnaissance with RMM tools, move laterally over RDP/SMB, and pivot to vCenter/ESXi. On ESXi they disable execInstalledOnly and dump credentials offline from a domain controller VMDK. Some actors chain the access with the Veeam exploit CVE-2023-27532. Hunters should check GlobalProtect logs for gateway-connected events from the listed IPs, the fake host IDs/MACs and the PoC client values. They should also look for VPN-to-vCenter access and ESXi security-setting changes.