Actor Profile

Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (tracked as Tarnished Scorpius) are financially-motivated ransomware operators actively exploiting authentication bypass vulnerabilities for initial access. Both groups conduct double-extortion attacks across multiple sectors, demonstrating advanced post-compromise capabilities including virtualization layer targeting and security control evasion. Their operations reflect a shift toward exploiting enterprise network infrastructure vulnerabilities rather than traditional phishing-based initial access vectors.

TTPs (Tactics, Techniques, Procedures)

Initial access via CVE-2026-0257 exploitation to establish unauthorized VPN sessions with MFA bypass (T1133 - External Remote Services, T1078 - Valid Accounts). Post-compromise activities include network reconnaissance using dual-use RMM tools (T1018 - Remote System Discovery), lateral movement via RDP and SMB (T1021.001 - Remote Desktop Protocol, T1021.002 - SMB/Windows Admin Shares), credential harvesting including offline VMDK-based domain controller credential dumping (T1003 - OS Credential Dumping), targeting of virtualization infrastructure including vCenter and ESXi hypervisors with security control disablement (T1562.001 - Disable or Modify Tools), exploitation of Veeam backup infrastructure via CVE-2023-27532 (T1490 - Inhibit System Recovery), data exfiltration (T1041 - Exfiltration Over C2 Channel), and ransomware deployment (T1486 - Data Encrypted for Impact).

Targets & Patterns

Both groups target a broad range of sectors including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. The wide sectoral targeting suggests opportunistic victim selection based on vulnerability presence rather than strategic sector focus. The groups demonstrate particular interest in organizations with virtualized infrastructure, as evidenced by their direct pivoting to vCenter and ESXi environments. Backup infrastructure (Veeam) is specifically targeted to maximize operational impact and prevent recovery, consistent with double-extortion ransomware tactics.

Historical Context

CVE-2026-0257 was patched by Palo Alto Networks in May 2026 and added to CISA's KEV catalog on May 13, 2026, indicating immediate recognition of active exploitation. Arctic Wolf previously flagged Qilin's exploitation of this vulnerability in July 2026, documenting attacks ranging from rapid encryption-only operations to full double-extortion campaigns. ReliaQuest detected both Qilin and Settra ransomware groups exploiting the flaw in financially-motivated attacks prior to the October 2026 Unit 42 disclosure. The continued exploitation months after patching reflects persistent targeting of unpatched enterprise VPN infrastructure, consistent with broader ransomware actor trends of exploiting edge network devices for initial access.

Defensive Recommendations

  • Immediately patch CVE-2026-0257 on all PAN-OS and Prisma Access instances; prioritize internet-facing VPN gateways
  • Hunt for unauthorized VPN sessions and gateway-connected events in PAN-OS logs, particularly successful authentication events without corresponding MFA validation
  • Monitor for lateral movement patterns via RDP (T1021.001) and SMB (T1021.002) originating from VPN gateway subnets; alert on unusual RMM tool deployment
  • Implement virtualization layer monitoring to detect unauthorized access to vCenter, ESXi security control modifications (execInstalledOnly changes), and VMDK file access patterns indicative of offline credential dumping (T1003)
  • Patch CVE-2023-27532 in Veeam backup infrastructure and restrict network access to backup management interfaces; monitor for unauthorized backup configuration changes (T1490)