Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware

### Executive Summary During June 2026 Arctic Wolf Labs investigated multiple intrusions where CVE-2026-0257 was exploited to bypass GlobalProtect authentication, enabling threat actors to perform credential theft (LSASS/NTDS), lateral movement (PsExec, RDP), persistence, selective or enterprise-wide Qilin ransomware encryption, and in some cases data exfiltration for double-extortion; the report provides technical details, IOCs, and prioritized defensive guidance.