Multiple ransomware groups have exploited a critical authentication bypass in Palo Alto Networks’ firewall software since June, compromising organisations across numerous sectors including UK infrastructure, The Register reports. Unit 42, Palo Alto’s own threat intelligence arm, has been tracking the campaign after discovering that attackers leveraged a flaw in PAN-OS GlobalProtect to gain initial access without valid credentials.
The vulnerability
The flaw, tracked as CVE-2026-0257, affects the GlobalProtect portal component of PAN-OS, the operating system that runs Palo Alto’s PA-Series and VM-Series firewalls. Attackers abuse an authentication bypass vulnerability that allows them to circumvent multi-factor authentication and establish a foothold on networks connected to vulnerable appliances. Unit 42’s investigation, which began in early June, identified two ransomware groups — Qilin and Inc — as the primary operators leveraging the bug. Both groups have previously targeted critical infrastructure in the UK and Europe, raising alarms among British security agencies.
How the attacks unfold
Once inside a compromised network, the attackers use stolen credentials to perform lateral movement through RDP and SMB protocols, accessing domain controllers and VMware ESXi virtualisation hosts. A custom tool was found dumping credentials directly from ESXi VMDK files, giving the groups persistence across reboots and the ability to deploy ransomware payloads hours or days later. The attacks have affected organisations across education, finance, healthcare, technology, hospitality, manufacturing, professional services, government, transport, utilities and retail — sectors that handle sensitive data and cannot afford prolonged outages.
UK exposure
British organisations running PAN-OS GlobalProtect portals are advised to patch immediately, as the National Cyber Security Centre has added the threat to its security advisories. The NCSC’s latest alert notes that UK healthcare trusts, local councils and transport operators have been among the most aggressively targeted, with attackers exploiting remote access configurations that became ubiquitous during the shift to hybrid working. The vulnerability is particularly dangerous because firewalls sit at the network perimeter — compromising them can expose entire downstream infrastructures, including systems that were otherwise air-gapped or segmented.
Why it matters
For British citizens, the implications extend beyond corporate boardrooms. NHS trusts that process patient records through vulnerable endpoints, local councils managing social care data, and energy grid operators protecting critical systems all face elevated risk. The ransomware groups behind these attacks have shown willingness to leak sensitive personal data publicly when negotiations break down, which means medical records, council files and utility customer databases could end up exposed. The UK government is reportedly preparing updated cyber insurance guidelines in response to the wave of incidents.
What happens next
Palo Alto Networks released patches for CVE-2026-0257 in September, but Unit 42 warns that many organisations have not yet applied them. The NCSC expects the attack rate to persist through the end of the year as groups continue to exploit laggard deployments. Organisations that remain unpatched should disable GlobalProtect portals where possible, enforce network segmentation, and implement additional monitoring for unusual RDP and SMB traffic. Security researchers note that the sophistication of these attacks — particularly the ESXi credential dumping tool — suggests state-sponsored actors may be providing support to the ransomware groups, blurring the line between criminal and geopolitical threats.
We do not allow links of any sort in comments. No SPAM whatsoever. On topic comments only.