Critical Palo Alto PAN-OS VPN Bug CVE-2024-3400 Exploited to Steal Credentials

Key Takeaways

• Ransomware groups are actively exploiting a critical vulnerability (CVE-2026-0257) in Palo Alto Networks GlobalProtect VPN.
• The flaw allows attackers to bypass multi-factor authentication and gain unauthorized network access.
• Exploitation has been observed across multiple sectors, leading to credential theft, data exfiltration, and ransomware deployment.
• A notable attack method involved extracting credentials directly from virtual machine disks, bypassing endpoint security.
• Patches are available, and immediate updates or mitigations are strongly recommended.

Ransomware operators are leveraging a critical flaw within Palo Alto Networks’ GlobalProtect VPN to circumvent multi-factor authentication (MFA) and infiltrate corporate networks. In one sophisticated incident, threat actors successfully accessed VMware management systems and exfiltrated credentials directly from a domain controller’s virtual disk, effectively bypassing security tools designed to operate within the virtual machine itself.

Palo Alto Networks’ Unit 42 detailed this ongoing malicious activity in an October 19 threat brief update. Researchers have attributed the exploitation of CVE-2026-0257 to several prominent threat groups, including Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc.). Independent public reports have also linked the exploitation to actors deploying Settra ransomware.

Investigations into these attacks, which commenced in early June, have spanned a wide array of sectors, including healthcare, education, financial services, manufacturing, government, and energy. The latest findings underscore how initial unauthorized VPN access can rapidly escalate into severe consequences such as credential theft, data exfiltration, and the deployment of ransomware.

GlobalProtect Flaw Bypasses MFA

The vulnerability specifically impacts GlobalProtect portals and gateways within certain PAN-OS and Prisma Access deployments. For exploitation to occur, authentication override cookies must be enabled in conjunction with a misconfigured certificate setup. Palo Alto Networks has rated this flaw as High severity, assigning it a CVSS score of 7.8 and indicating its highest recommended response urgency. It’s important to note that Panorama and Cloud NGFW products are not affected by this vulnerability.

Authentication override cookies are designed to facilitate seamless reconnection for previously authenticated users without requiring a full re-login. According to Rapid7’s technical analysis, vulnerable devices are capable of decrypting these cookies but fail to adequately verify their origin from a trusted system.

If the same cookie certificate is inadvertently reused for another publicly accessible service, attackers can obtain its public key and subsequently forge a malicious cookie. This forged cookie can then be accepted by the gateway as valid authentication, granting a VPN connection that bypasses standard login procedures and MFA checks. This GlobalProtect authentication bypass has been previously reported in cybersecurity news.

Post-Exploitation Tactics

Once initial access is established, attackers typically employ remote monitoring and management tools to reconnoiter internal networks. They then utilize protocols such as Remote Desktop Protocol (RDP) and Server Message Block (SMB) to move laterally between systems, preparing for subsequent stages like credential harvesting, data theft, and ransomware deployment.

A particularly sophisticated attack involved movement from the compromised VPN gateway to a VMware vCenter management appliance. From there, attackers disabled the execInstalledOnly security control on ESXi hosts and deployed a custom tool to extract credentials offline from a domain controller’s VMDK virtual disk. Unit 42 did not disclose the name or implementation specifics of this custom tool.

Harvesting credentials directly from the virtual disk circumvents endpoint detection and response (EDR) controls that would typically be running within the affected virtual machine. This technique targets the underlying infrastructure rather than relying on malware executing inside the operating system. Attacks involving detached domain controller disks in VMware environments have been documented in cybersecurity reporting previously.

Unit 42 also observed attackers combining this initial access with tools targeting Veeam backup infrastructure via CVE-2023-27532. This separate vulnerability can expose encrypted credentials stored within the backup configuration database, potentially granting further access to backup hosts.

What You Should Do

• Patch Immediately: Organizations must consult the Palo Alto Networks advisory and upgrade all affected GlobalProtect portals and gateways without delay.
• Implement Temporary Mitigations: If immediate patching is not feasible, disable authentication override cookies or generate a new, dedicated certificate exclusively for override cookies.
• Review Logs for Suspicious Activity: Examine GlobalProtect logs for successful gateway-connected events originating from unusual sources or client details. Specific indicators of compromise (IoCs) include IP addresses 104.207.144[.]154 and 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host IDs aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. Note that many initial probes may not establish full VPN sessions, making all connection events critical for investigation.
• Enhance Monitoring: Strengthen monitoring for lateral movement, credential access attempts, and unusual activity on VMware environments and backup infrastructure.
• Strengthen MFA: Ensure MFA is enforced rigorously across all critical systems and consider advanced MFA solutions that resist common bypass techniques.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.