Qilin and Settra ransomware crews are using a PAN-OS VPN bypass disclosed in May

The bypass ends in a VPN session that looks routine ^[1]. ReliaQuest said, "Because this access originates through an organization's own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft or ransomware deployment is underway." ^[9]

The firm's guidance puts session cleanup after the upgrade. Operators should switch off authentication override cookies wherever they aren't needed, end every active GlobalProtect session once the patch is in, and look into connections they did not expect, such as sessions from hostnames like "kali" ^[10]. ReliaQuest said, "Patching alone may not remove access established before remediation." ^[11]

The timeline is long. ReliaQuest's advisory came 149 days after Palo Alto's May 13 disclosure ^[14]. In its own notice, Palo Alto described only "limited exploit attempts on unpatched PAN-OS devices without mitigations applied" ^[13]. Infosecurity Magazine reports that some systems appear to remain unpatched ^[12].

In our view that sequence is a flaw in steady use for five months that has now reached ransomware operators. The sources do not say whether the same actors sit behind the earlier Rapid7, Unit 42 and Arctic Wolf reports.

Score is a weak guide here. Infosecurity Magazine describes a 7.8 as high-severity ^[5], and a queue sorted by score alone would rank it behind any critical-rated flaw. For a gateway on the affected list, the exploitation reports outrank the score.

The ransomware link rests on ReliaQuest alone. The article does not say how many organizations were breached, and the earlier vendor reports are described only as attempted exploitation ^[6].