Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

**Active exploitation of PAN-OS CVE-2026-0257 leads to Qilin/Agenda ransomware intrusions:** Arctic Wolf Labs investigated multiple June 2026 intrusions where attackers bypassed authentication to create SSL VPN sessions, escalated to credential harvesting and lateral movement (PsExec, administrative shares), staged ransomware at C:\PerfLogs, disabled Defender and cleared logs, and in some cases exfiltrated data to MEGA using tools like Rclone before encryption — behaviors consistent with a ransomware-as-a-service affiliate model.