{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Exploitation of CVE-2026-0257 is what ransomware operators use for initial access. A negative result verifies that perimeter bypasses have not occurred within the retention window." }, "name": "VPN Gateway Exploitation and Unauthorized Authentication", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1133", "attack.t1078", "attack.t1021.001", "credential access", "defense evasion", "discovery", "impact", "initial access", "lateral movement", "persistence" ], "series": { "slug": "threat-brief-active-exploitation-of-pan-os-cve-2026-0257-updated-october-19", "index": 1, "title": "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)", "total": 2 }, "related": [ { "hunt": "lateral-movement-vcenter-pivot", "reason": "This hunt focuses on the perimeter; downstream movement from the gateway to vCenter belongs in a sibling hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single detection rule on malicious IPs is insufficient given the speed of infrastructure rotation. This hunt correlates vulnerability posture with stack-counted behavior (rare user agents) and specific exploit PoC signatures that attackers use and which may not fire a standard alert.", "coverage": [ { "stage": "initial-access-pan-os-exploit", "steps": [ "vulnerable-gateways", "exploit-indicators" ], "status": "covered" }, { "stage": "unauthorized-vpn-persistence", "steps": [ "rare-vpn-user-agents", "exploit-indicators" ], "status": "covered" }, { "stage": "lateral-movement-vcenter-pivot", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-esxi-security", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "credential-access-offline-vmdk", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "discovery-rmm-recon", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "impact-ransomware-encryption", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "PAN-OS GlobalProtect Exploitation", "slug": "initial-access-pan-os-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-0257", "23.128.228.6", "104.207.144.154", "146.19.216.119", "146.19.216.120", "146.19.216.125", "179.43.172.213", "185.195.232.139", "198.12.106.60", "202.144.192.47" ] }, { "name": "Unauthorized VPN Session Establishment", "slug": "unauthorized-vpn-persistence", "tactic": "persistence", "techniques": [ "T1133" ], "observables": [ "aa:bb:cc:dd:ee:ff", "00:11:22:33:44:55", "WINDOWS-LAPTOP-001", "DESKTOP-GP01", "GP-CLIENT", "Microsoft Windows 10 Pro 64-bit" ] }, { "name": "Pivot to Virtualization Layer", "slug": "lateral-movement-vcenter-pivot", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "RDP to vCenter management appliance", "SMB lateral movement" ] }, { "name": "Disabling ESXi Security Controls", "slug": "defense-evasion-esxi-security", "tactic": "defense-evasion", "techniques": [ "T1562.001" ], "observables": [ "execInstalledOnly disabled on ESXi hypervisors" ] }, { "name": "Offline Virtual Disk Credential Dumping", "slug": "credential-access-offline-vmdk", "tactic": "credential-access", "techniques": [ "T1003" ], "observables": [ "Custom tool for VMDK dumping", "Dumping Domain Controller virtual disks", "CVE-2023-27532", "Veeam backup infrastructure exploitation" ] }, { "name": "Internal Reconnaissance with RMM", "slug": "discovery-rmm-recon", "tactic": "discovery", "techniques": [ "T1046" ], "observables": [ "Dual-use RMM tools" ] }, { "name": "Data Encryption for Impact", "slug": "impact-ransomware-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Qilin ransomware", "Inc ransomware", "Settra ransomware" ] } ], "summary": "Ransomware operators including Qilin and Inc exploit CVE-2026-0257 to bypass authentication on Palo Alto Networks GlobalProtect gateways, establishing unauthorized VPN sessions. Attackers then pivot to the virtualization layer (vCenter/ESXi) to disable security controls and perform offline credential dumping against domain controller virtual disks before deploying ransomware." }, "severity": "critical", "rationale": "Start by examining hb_vulnerability_finding for CVE-2026-0257. If the estate does not have posture scanning for network devices, run the authentication queries globally across the perimeter fleet.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has exploited CVE-2026-0257 on a PAN-OS gateway to bypass authentication and establish a VPN session, identifiable by suspicious client hostnames, MAC addresses, or PoC-specific user agents.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of gateway hostnames to focus the hunt." }, "attacker_ips": { "from": { "ref": "unit-42-cve-2026-0257", "kind": "article", "observed": "2026-10-19" }, "type": "list[ip]", "default": [ "23.128.228.6", "104.207.144.154", "146.19.216.119", "146.19.216.120", "146.19.216.125", "179.43.172.213", "185.195.232.139", "198.12.106.60", "202.144.192.47" ], "description": "Known attacker IP addresses from Unit 42 research." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "suspicious_ids": { "from": { "ref": "unit-42-cve-2026-0257", "kind": "article", "observed": "2026-10-19" }, "type": "list[string]", "default": [ "aa:bb:cc:dd:ee:ff", "00:11:22:33:44:55", "windows-laptop-001", "desktop-gp01", "gp-client" ], "description": "Suspicious host IDs and MAC addresses observed in unauthorized sessions (lowercase)." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "name": "Unit 42 \u2014 Active Exploitation of PAN-OS CVE-2026-0257" } ], "blind_spots": [ { "id": "missing-auth-telemetry", "risk": "A successful authentication bypass on a non-logging gateway would be invisible to this hunt.", "stage": "initial-access-pan-os-exploit", "question": "Whether unauthorized logins occurred on gateways that do not export authentication telemetry.", "requires": "VPN gateway logs forwarded to hb_auth_signin" }, { "id": "identifier-rotation", "risk": "The exploit-indicators query relies on research-provided IDs; if rotated, only the user-agent prevalence step remains.", "stage": "unauthorized-vpn-persistence", "question": "Whether the attacker rotated MAC addresses or hostnames to corporate standards.", "requires": "Persistent client identifiers in logs" } ] }, "name": "VPN Gateway Exploitation and Unauthorized Authentication", "description": "This hunt targets the initial access and persistence phases of the CVE-2026-0257 exploitation campaign. It first identifies perimeter devices with known vulnerabilities, then fan-outs to analyze VPN sign-ins for two distinct signals: known malicious infrastructure and behavioral outliers in client configurations. A prevalence-based baseline of user agents is used to isolate PoC-specific strings from corporate fleet noise. An agent then correlates these findings to identify successful unauthorized sessions that bypassed multi-factor authentication." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "threat-brief-active-exploitation-of-pan-os-cve-2026-0257-updated-october-19", "index": 1, "title": "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)", "total": 2 }, "coverage": [ { "stage": "initial-access-pan-os-exploit", "steps": [ "vulnerable-gateways", "exploit-indicators" ], "status": "covered" }, { "stage": "unauthorized-vpn-persistence", "steps": [ "rare-vpn-user-agents", "exploit-indicators" ], "status": "covered" }, { "stage": "lateral-movement-vcenter-pivot", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-esxi-security", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "credential-access-offline-vmdk", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "discovery-rmm-recon", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "impact-ransomware-encryption", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" } ], "rationale": "An attacker has exploited CVE-2026-0257 on a PAN-OS gateway to bypass authentication and establish a VPN session, identifiable by suspicious client hostnames, MAC addresses, or PoC-specific user agents.", "blind_spots": [ { "id": "missing-auth-telemetry", "risk": "A successful authentication bypass on a non-logging gateway would be invisible to this hunt.", "stage": "initial-access-pan-os-exploit", "question": "Whether unauthorized logins occurred on gateways that do not export authentication telemetry.", "requires": "VPN gateway logs forwarded to hb_auth_signin" }, { "id": "identifier-rotation", "risk": "The exploit-indicators query relies on research-provided IDs; if rotated, only the user-agent prevalence step remains.", "stage": "unauthorized-vpn-persistence", "question": "Whether the attacker rotated MAC addresses or hostnames to corporate standards.", "requires": "Persistent client identifiers in logs" } ], "scoping_notes": "Start by examining hb_vulnerability_finding for CVE-2026-0257. If the estate does not have posture scanning for network devices, run the authentication queries globally across the perimeter fleet.", "beyond_detection": "A single detection rule on malicious IPs is insufficient given the speed of infrastructure rotation. This hunt correlates vulnerability posture with stack-counted behavior (rare user agents) and specific exploit PoC signatures that attackers use and which may not fire a standard alert." } }, { "id": "vulnerable-gateways", "type": "query", "label": "Identify vulnerable PAN-OS gateways", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, resource_uid, cve_uid, severity, collected_at FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-0257' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Scope the hunt to perimeter devices confirmed as vulnerable to CVE-2026-0257 by posture scanning.", "expected_signal": "Rows identify specific vulnerable devices. Silence suggests no active vulnerability findings for this CVE are currently recorded." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable PAN-OS gateways", "reads": [ "device_uid", "resource_uid", "cve_uid", "severity", "collected_at", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, resource_uid, cve_uid, severity, collected_at FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-0257' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "Rows identify specific vulnerable devices. Silence suggests no active vulnerability findings for this CVE are currently recorded.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "rare-vpn-user-agents", "type": "query", "label": "Stack-count VPN user agents", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT LOWER(user_agent) AS ua_string, COUNT(DISTINCT device_hostname) AS hosts_seen, COUNT(*) AS login_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(user_agent) HAVING hosts_seen <= 3 ORDER BY hosts_seen ASC, login_count DESC", "surface": "hb_auth_signin", "description": "Identify rare user agents that may correspond to PoC code or attacker-specific client software.", "expected_signal": "A list of user agents seen on very few hosts. The PoC agent Microsoft Windows 10 Pro 64-bit or similar variants should stand out." }, "parents": [ { "id": "vulnerable-gateways" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Stack-count VPN user agents", "reads": [ "user_agent", "device_hostname", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT LOWER(user_agent) AS ua_string, COUNT(DISTINCT device_hostname) AS hosts_seen, COUNT(*) AS login_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(user_agent) HAVING hosts_seen <= 3 ORDER BY hosts_seen ASC, login_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of user agents seen on very few hosts. The PoC agent Microsoft Windows 10 Pro 64-bit or similar variants should stand out.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "user_agent" ], "rare_below": 3 }, "verified_at": "2026-10-20" } }, { "id": "exploit-indicators", "type": "query", "label": "VPN logins matching exploit indicators", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT time, device_hostname, src_endpoint_ip, src_endpoint_hostname, src_endpoint_address, actor_user_name, user_agent FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_id = 1 AND (instr(',' || '{{attacker_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_hostname) || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_address) || ',') > 0 OR (LOWER(user_agent) LIKE '%windows 10 pro%' AND (actor_user_domain IS NULL OR actor_user_domain = '' OR actor_user_domain = '-'))) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Directly match successful sessions against the malicious IPs and suspicious client IDs named in the research.", "expected_signal": "Any row indicates a session using known exploit material. Silence proves these specific indicators did not successfully authenticate." }, "parents": [ { "id": "vulnerable-gateways" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "VPN logins matching exploit indicators", "reads": [ "time", "device_hostname", "src_endpoint_ip", "src_endpoint_hostname", "src_endpoint_address", "actor_user_name", "user_agent", "status_id", "actor_user_domain" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT time, device_hostname, src_endpoint_ip, src_endpoint_hostname, src_endpoint_address, actor_user_name, user_agent FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_id = 1 AND (instr(',' || '{{attacker_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_hostname) || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_address) || ',') > 0 OR (LOWER(user_agent) LIKE '%windows 10 pro%' AND (actor_user_domain IS NULL OR actor_user_domain = '' OR actor_user_domain = '-'))) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Any row indicates a session using known exploit material. Silence proves these specific indicators did not successfully authenticate.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "triage-agent", "type": "analytic", "label": "Weigh gateway exploitation evidence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "vulnerable-gateways", "rare-vpn-user-agents", "exploit-indicators" ], "objective": "Determine if any vulnerable PAN-OS gateway shows evidence of successful unauthorized VPN session establishment using exploit indicators.", "description": "Correlate the vulnerability scoping with authentication triage to determine if an unauthorized VPN session was established.", "max_iterations": 6, "expected_signal": "A per-host verdict of malicious, suspicious, or benign citing relevant login and vulnerability rows.", "success_criteria": "A verdict for each gateway citing the login rows that match exploit indicators or show rare user-agent patterns." }, "parents": [ { "id": "rare-vpn-user-agents", "kind": "merge" }, { "id": "exploit-indicators", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on agent verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for at least one gateway", "condition": "the triage-agent verdict is malicious for at least one gateway", "blind_spot": "missing-auth-telemetry", "confidence": "high", "description": "Direct high-confidence findings to containment and ambiguous findings to analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-gateway", "type": "action", "label": "Isolate compromised gateway", "config": { "target": "endpoint", "description": "Sever active attacker sessions and prevent further ingress.", "instructions": "Isolate the affected PAN-OS gateway. Forcefully terminate all active VPN sessions and initiate a password reset for any accounts cited in the malicious findings.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-validation", "type": "task", "label": "Analyst validation and pivot", "config": { "assignee": "analyst", "description": "Verify the agent's findings and begin hunting for internal lateral movement.", "instructions": "Review the cited rows in hb_auth_signin. Confirm if the source IP or client hostname matches the report indicators. Search internal logs for subsequent auth attempts (RDP/SMB) from the compromised accounts." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-gateway" } ] }, { "id": "remediation-and-closeout", "type": "task", "label": "Remediation and close out", "config": { "assignee": "analyst", "description": "Ensure the vulnerability is patched and document the hunt outcome.", "instructions": "Verify that all PAN-OS gateways have been updated to a version containing the fix for CVE-2026-0257. Document any false positives from the prevalence step for future tuning." }, "parents": [ { "id": "analyst-validation" } ] } ] }