Qilin and INC Exploited a Patched Palo Alto VPN Bypass for Four Months. ConnectWise Shows Where the Same Trust Failure Went Next.
Photo: Forkast
Ransomware operators have spent roughly four months monetizing a critical authentication bypass in Palo Alto Networks GlobalProtect VPN software. While the vulnerability was patched in May, Unit 42 reported on October 19 that the threat actors behind the Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, or INC, ransomware groups were actively exploiting the flaw to gain initial network access. Public reporting on the extent of this campaign emerged on October 21.
Source: Forkast
