Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware

**Executive summary:** In June 2026 Arctic Wolf Labs investigated multiple intrusions that leveraged CVE-2026-0257 in Palo Alto GlobalProtect to establish authenticated VPN sessions, perform LSASS dumps and NTDS extraction for domain-wide credential compromise, stage Qilin ransomware at C:\PerfLogs\win.exe, move laterally via PsExec/admin shares, and in some cases exfiltrate data to cloud services (MEGA) prior to double-extortion ransomware deployment.