VPN Gateway Exploitation and Unauthorized Authentication

Source

---
analysis: A single detection rule on malicious IPs is insufficient given the speed
  of infrastructure rotation. This hunt correlates vulnerability posture with stack-counted
  behavior (rare user agents) and specific exploit PoC signatures that attackers use
  and which may not fire a standard alert.
blind_spots:
- id: missing-auth-telemetry
  question: Whether unauthorized logins occurred on gateways that do not export authentication
    telemetry.
  requires: VPN gateway logs forwarded to hb_auth_signin
  risk: A successful authentication bypass on a non-logging gateway would be invisible
    to this hunt.
  stage: initial-access-pan-os-exploit
- id: identifier-rotation
  question: Whether the attacker rotated MAC addresses or hostnames to corporate standards.
  requires: Persistent client identifiers in logs
  risk: The exploit-indicators query relies on research-provided IDs; if rotated,
    only the user-agent prevalence step remains.
  stage: unauthorized-vpn-persistence
coverage:
- stage: initial-access-pan-os-exploit
  status: covered
  steps:
  - vulnerable-gateways
  - exploit-indicators
- stage: unauthorized-vpn-persistence
  status: covered
  steps:
  - rare-vpn-user-agents
  - exploit-indicators
- reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS
    CVE-2026-0257 (Updated October 19)'' series.'
  stage: lateral-movement-vcenter-pivot
  status: out_of_scope
- reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS
    CVE-2026-0257 (Updated October 19)'' series.'
  stage: defense-evasion-esxi-security
  status: out_of_scope
- reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS
    CVE-2026-0257 (Updated October 19)'' series.'
  stage: credential-access-offline-vmdk
  status: out_of_scope
- reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS
    CVE-2026-0257 (Updated October 19)'' series.'
  stage: discovery-rmm-recon
  status: out_of_scope
- reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS
    CVE-2026-0257 (Updated October 19)'' series.'
  stage: impact-ransomware-encryption
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Exploitation of CVE-2026-0257 is what ransomware operators use for
    initial access. A negative result verifies that perimeter bypasses have not occurred
    within the retention window.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker has exploited CVE-2026-0257 on a PAN-OS gateway to bypass
  authentication and establish a VPN session, identifiable by suspicious client hostnames,
  MAC addresses, or PoC-specific user agents.
labels:
- hunt
- attack.t1190
- attack.t1133
- attack.t1078
- attack.t1021.001
- credential access
- defense evasion
- discovery
- impact
- initial access
- lateral movement
- persistence
name: VPN Gateway Exploitation and Unauthorized Authentication
parameters:
  attacker_ips:
    default:
    - 23.128.228.6
    - 104.207.144.154
    - 146.19.216.119
    - 146.19.216.120
    - 146.19.216.125
    - 179.43.172.213
    - 185.195.232.139
    - 198.12.106.60
    - 202.144.192.47
    description: Known attacker IP addresses from Unit 42 research.
    from:
      kind: article
      observed: '2026-10-19'
      ref: unit-42-cve-2026-0257
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional list of gateway hostnames to focus the hunt.
    type: list[host]
  suspicious_ids:
    default:
    - aa:bb:cc:dd:ee:ff
    - 00:11:22:33:44:55
    - windows-laptop-001
    - desktop-gp01
    - gp-client
    description: Suspicious host IDs and MAC addresses observed in unauthorized sessions
      (lowercase).
    from:
      kind: article
      observed: '2026-10-19'
      ref: unit-42-cve-2026-0257
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Start by examining hb_vulnerability_finding for CVE-2026-0257. If the estate
  does not have posture scanning for network devices, run the authentication queries
  globally across the perimeter fleet.
references:
- name: "Unit 42 \u2014 Active Exploitation of PAN-OS CVE-2026-0257"
  url: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
related:
- hunt: lateral-movement-vcenter-pivot
  reason: This hunt focuses on the perimeter; downstream movement from the gateway
    to vCenter belongs in a sibling hunt.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: PAN-OS GlobalProtect Exploitation
    observables:
    - CVE-2026-0257
    - 23.128.228.6
    - 104.207.144.154
    - 146.19.216.119
    - 146.19.216.120
    - 146.19.216.125
    - 179.43.172.213
    - 185.195.232.139
    - 198.12.106.60
    - 202.144.192.47
    slug: initial-access-pan-os-exploit
    tactic: initial-access
    techniques:
    - T1190
  - name: Unauthorized VPN Session Establishment
    observables:
    - aa:bb:cc:dd:ee:ff
    - 00:11:22:33:44:55
    - WINDOWS-LAPTOP-001
    - DESKTOP-GP01
    - GP-CLIENT
    - Microsoft Windows 10 Pro 64-bit
    slug: unauthorized-vpn-persistence
    tactic: persistence
    techniques:
    - T1133
  - name: Pivot to Virtualization Layer
    observables:
    - RDP to vCenter management appliance
    - SMB lateral movement
    slug: lateral-movement-vcenter-pivot
    tactic: lateral-movement
    techniques:
    - T1021.001
  - name: Disabling ESXi Security Controls
    observables:
    - execInstalledOnly disabled on ESXi hypervisors
    slug: defense-evasion-esxi-security
    tactic: defense-evasion
    techniques:
    - T1562.001
  - name: Offline Virtual Disk Credential Dumping
    observables:
    - Custom tool for VMDK dumping
    - Dumping Domain Controller virtual disks
    - CVE-2023-27532
    - Veeam backup infrastructure exploitation
    slug: credential-access-offline-vmdk
    tactic: credential-access
    techniques:
    - T1003
  - name: Internal Reconnaissance with RMM
    observables:
    - Dual-use RMM tools
    slug: discovery-rmm-recon
    tactic: discovery
    techniques:
    - T1046
  - name: Data Encryption for Impact
    observables:
    - Qilin ransomware
    - Inc ransomware
    - Settra ransomware
    slug: impact-ransomware-encryption
    tactic: impact
    techniques:
    - T1486
  summary: Ransomware operators including Qilin and Inc exploit CVE-2026-0257 to bypass
    authentication on Palo Alto Networks GlobalProtect gateways, establishing unauthorized
    VPN sessions. Attackers then pivot to the virtualization layer (vCenter/ESXi)
    to disable security controls and perform offline credential dumping against domain
    controller virtual disks before deploying ransomware.
series:
  index: 1
  slug: threat-brief-active-exploitation-of-pan-os-cve-2026-0257-updated-october-19
  title: 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October
    19)'
  total: 2
severity: critical
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
tlp: clear
type: investigation
---


# VPN Gateway Exploitation and Unauthorized Authentication

This hunt targets the initial access and persistence phases of the CVE-2026-0257 exploitation campaign. It first identifies perimeter devices with known vulnerabilities, then fan-outs to analyze VPN sign-ins for two distinct signals: known malicious infrastructure and behavioral outliers in client configurations. A prevalence-based baseline of user agents is used to isolate PoC-specific strings from corporate fleet noise. An agent then correlates these findings to identify successful unauthorized sessions that bypassed multi-factor authentication.

## vulnerable-gateways
<!-- Identify vulnerable PAN-OS gateways -->
Scope the hunt to perimeter devices confirmed as vulnerable to CVE-2026-0257 by posture scanning.

```sqlite target=endpoint role=scoping
~~~yaml
expected: Rows identify specific vulnerable devices. Silence suggests no active vulnerability
  findings for this CVE are currently recorded.
reads:
- device_uid
- resource_uid
- cve_uid
- severity
- collected_at
- status
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT device_uid, resource_uid, cve_uid, severity, collected_at FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-0257' AND status != 'suppressed'
```

## correlate-vpn-activity
<!-- Correlate VPN activity fan-out -->
parallel:
- → rare-vpn-user-agents
- → exploit-indicators
join: → triage-agent

## rare-vpn-user-agents
<!-- Stack-count VPN user agents -->
Identify rare user agents that may correspond to PoC code or attacker-specific client software.

```sqlite target=identity role=baseline params=(lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: A list of user agents seen on very few hosts. The PoC agent Microsoft Windows
  10 Pro 64-bit or similar variants should stand out.
prevalence:
  by: device_hostname
  key:
  - user_agent
  rare_below: 3
reads:
- user_agent
- device_hostname
- status_id
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT LOWER(user_agent) AS ua_string, COUNT(DISTINCT device_hostname) AS hosts_seen, COUNT(*) AS login_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(user_agent) HAVING hosts_seen <= 3 ORDER BY hosts_seen ASC, login_count DESC
```

## exploit-indicators
<!-- VPN logins matching exploit indicators -->
Directly match successful sessions against the malicious IPs and suspicious client IDs named in the research.

```sqlite target=identity role=triage params=(scope_hosts=scope_hosts, attacker_ips=attacker_ips, suspicious_ids=suspicious_ids, lookback_days=lookback_days)
~~~yaml
expected: Any row indicates a session using known exploit material. Silence proves
  these specific indicators did not successfully authenticate.
reads:
- time
- device_hostname
- src_endpoint_ip
- src_endpoint_hostname
- src_endpoint_address
- actor_user_name
- user_agent
- status_id
- actor_user_domain
silence: evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-10-20'
~~~
SELECT time, device_hostname, src_endpoint_ip, src_endpoint_hostname, src_endpoint_address, actor_user_name, user_agent FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_id = 1 AND (instr(',' || '{{attacker_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_hostname) || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_address) || ',') > 0 OR (LOWER(user_agent) LIKE '%windows 10 pro%' AND (actor_user_domain IS NULL OR actor_user_domain = '' OR actor_user_domain = '-'))) AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-agent
<!-- Weigh gateway exploitation evidence -->
```agent target=hunter
cite: required
context:
- vulnerable-gateways
- rare-vpn-user-agents
- exploit-indicators
max_iterations: 6
objective: Determine if any vulnerable PAN-OS gateway shows evidence of successful
  unauthorized VPN session establishment using exploit indicators.
success_criteria: A verdict for each gateway citing the login rows that match exploit
  indicators or show rare user-agent patterns.
tools:
- endpoint
- identity
```

## route-on-verdict
<!-- Route on agent verdict -->
if~: "the triage-agent verdict is malicious for at least one gateway" (confidence: high, judge=hunter)
then: → isolate-gateway
indeterminate: → analyst-validation
unavailable: → analyst-validation (blind_spot: missing-auth-telemetry)
else: → analyst-validation

## isolate-gateway
<!-- Isolate compromised gateway -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the affected PAN-OS gateway. Forcefully terminate all active VPN sessions and initiate a password reset for any accounts cited in the malicious findings.
```
→ analyst-validation

## analyst-validation
<!-- Analyst validation and pivot -->
```manual target=analyst
Review the cited rows in hb_auth_signin. Confirm if the source IP or client hostname matches the report indicators. Search internal logs for subsequent auth attempts (RDP/SMB) from the compromised accounts.
```
→ remediation-and-closeout

## remediation-and-closeout
<!-- Remediation and close out -->
```manual target=analyst
Verify that all PAN-OS gateways have been updated to a version containing the fix for CVE-2026-0257. Document any false positives from the prevalence step for future tuning.
```
→ end