--- analysis: A single detection rule on malicious IPs is insufficient given the speed of infrastructure rotation. This hunt correlates vulnerability posture with stack-counted behavior (rare user agents) and specific exploit PoC signatures that attackers use and which may not fire a standard alert. blind_spots: - id: missing-auth-telemetry question: Whether unauthorized logins occurred on gateways that do not export authentication telemetry. requires: VPN gateway logs forwarded to hb_auth_signin risk: A successful authentication bypass on a non-logging gateway would be invisible to this hunt. stage: initial-access-pan-os-exploit - id: identifier-rotation question: Whether the attacker rotated MAC addresses or hostnames to corporate standards. requires: Persistent client identifiers in logs risk: The exploit-indicators query relies on research-provided IDs; if rotated, only the user-agent prevalence step remains. stage: unauthorized-vpn-persistence coverage: - stage: initial-access-pan-os-exploit status: covered steps: - vulnerable-gateways - exploit-indicators - stage: unauthorized-vpn-persistence status: covered steps: - rare-vpn-user-agents - exploit-indicators - reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)'' series.' stage: lateral-movement-vcenter-pivot status: out_of_scope - reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)'' series.' stage: defense-evasion-esxi-security status: out_of_scope - reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)'' series.' stage: credential-access-offline-vmdk status: out_of_scope - reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)'' series.' stage: discovery-rmm-recon status: out_of_scope - reason: 'Belongs to another part of the ''Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)'' series.' stage: impact-ransomware-encryption status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Exploitation of CVE-2026-0257 is what ransomware operators use for initial access. A negative result verifies that perimeter bypasses have not occurred within the retention window. methodology: model-assisted trigger: intel-report hypothesis: An attacker has exploited CVE-2026-0257 on a PAN-OS gateway to bypass authentication and establish a VPN session, identifiable by suspicious client hostnames, MAC addresses, or PoC-specific user agents. labels: - hunt - attack.t1190 - attack.t1133 - attack.t1078 - attack.t1021.001 - credential access - defense evasion - discovery - impact - initial access - lateral movement - persistence name: VPN Gateway Exploitation and Unauthorized Authentication parameters: attacker_ips: default: - 23.128.228.6 - 104.207.144.154 - 146.19.216.119 - 146.19.216.120 - 146.19.216.125 - 179.43.172.213 - 185.195.232.139 - 198.12.106.60 - 202.144.192.47 description: Known attacker IP addresses from Unit 42 research. from: kind: article observed: '2026-10-19' ref: unit-42-cve-2026-0257 type: list[ip] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of gateway hostnames to focus the hunt. type: list[host] suspicious_ids: default: - aa:bb:cc:dd:ee:ff - 00:11:22:33:44:55 - windows-laptop-001 - desktop-gp01 - gp-client description: Suspicious host IDs and MAC addresses observed in unauthorized sessions (lowercase). from: kind: article observed: '2026-10-19' ref: unit-42-cve-2026-0257 type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Start by examining hb_vulnerability_finding for CVE-2026-0257. If the estate does not have posture scanning for network devices, run the authentication queries globally across the perimeter fleet. references: - name: "Unit 42 \u2014 Active Exploitation of PAN-OS CVE-2026-0257" url: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ related: - hunt: lateral-movement-vcenter-pivot reason: This hunt focuses on the perimeter; downstream movement from the gateway to vCenter belongs in a sibling hunt. relation: out-of-scope-alternative scenario: stages: - name: PAN-OS GlobalProtect Exploitation observables: - CVE-2026-0257 - 23.128.228.6 - 104.207.144.154 - 146.19.216.119 - 146.19.216.120 - 146.19.216.125 - 179.43.172.213 - 185.195.232.139 - 198.12.106.60 - 202.144.192.47 slug: initial-access-pan-os-exploit tactic: initial-access techniques: - T1190 - name: Unauthorized VPN Session Establishment observables: - aa:bb:cc:dd:ee:ff - 00:11:22:33:44:55 - WINDOWS-LAPTOP-001 - DESKTOP-GP01 - GP-CLIENT - Microsoft Windows 10 Pro 64-bit slug: unauthorized-vpn-persistence tactic: persistence techniques: - T1133 - name: Pivot to Virtualization Layer observables: - RDP to vCenter management appliance - SMB lateral movement slug: lateral-movement-vcenter-pivot tactic: lateral-movement techniques: - T1021.001 - name: Disabling ESXi Security Controls observables: - execInstalledOnly disabled on ESXi hypervisors slug: defense-evasion-esxi-security tactic: defense-evasion techniques: - T1562.001 - name: Offline Virtual Disk Credential Dumping observables: - Custom tool for VMDK dumping - Dumping Domain Controller virtual disks - CVE-2023-27532 - Veeam backup infrastructure exploitation slug: credential-access-offline-vmdk tactic: credential-access techniques: - T1003 - name: Internal Reconnaissance with RMM observables: - Dual-use RMM tools slug: discovery-rmm-recon tactic: discovery techniques: - T1046 - name: Data Encryption for Impact observables: - Qilin ransomware - Inc ransomware - Settra ransomware slug: impact-ransomware-encryption tactic: impact techniques: - T1486 summary: Ransomware operators including Qilin and Inc exploit CVE-2026-0257 to bypass authentication on Palo Alto Networks GlobalProtect gateways, establishing unauthorized VPN sessions. Attackers then pivot to the virtualization layer (vCenter/ESXi) to disable security controls and perform offline credential dumping against domain controller virtual disks before deploying ransomware. series: index: 1 slug: threat-brief-active-exploitation-of-pan-os-cve-2026-0257-updated-october-19 title: 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' total: 2 severity: critical targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # VPN Gateway Exploitation and Unauthorized Authentication This hunt targets the initial access and persistence phases of the CVE-2026-0257 exploitation campaign. It first identifies perimeter devices with known vulnerabilities, then fan-outs to analyze VPN sign-ins for two distinct signals: known malicious infrastructure and behavioral outliers in client configurations. A prevalence-based baseline of user agents is used to isolate PoC-specific strings from corporate fleet noise. An agent then correlates these findings to identify successful unauthorized sessions that bypassed multi-factor authentication. ## vulnerable-gateways Scope the hunt to perimeter devices confirmed as vulnerable to CVE-2026-0257 by posture scanning. ```sqlite target=endpoint role=scoping ~~~yaml expected: Rows identify specific vulnerable devices. Silence suggests no active vulnerability findings for this CVE are currently recorded. reads: - device_uid - resource_uid - cve_uid - severity - collected_at - status silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-10-20' ~~~ SELECT device_uid, resource_uid, cve_uid, severity, collected_at FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-0257' AND status != 'suppressed' ``` ## correlate-vpn-activity parallel: - → rare-vpn-user-agents - → exploit-indicators join: → triage-agent ## rare-vpn-user-agents Identify rare user agents that may correspond to PoC code or attacker-specific client software. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A list of user agents seen on very few hosts. The PoC agent Microsoft Windows 10 Pro 64-bit or similar variants should stand out. prevalence: by: device_hostname key: - user_agent rare_below: 3 reads: - user_agent - device_hostname - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-20' ~~~ SELECT LOWER(user_agent) AS ua_string, COUNT(DISTINCT device_hostname) AS hosts_seen, COUNT(*) AS login_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(user_agent) HAVING hosts_seen <= 3 ORDER BY hosts_seen ASC, login_count DESC ``` ## exploit-indicators Directly match successful sessions against the malicious IPs and suspicious client IDs named in the research. ```sqlite target=identity role=triage params=(scope_hosts=scope_hosts, attacker_ips=attacker_ips, suspicious_ids=suspicious_ids, lookback_days=lookback_days) ~~~yaml expected: Any row indicates a session using known exploit material. Silence proves these specific indicators did not successfully authenticate. reads: - time - device_hostname - src_endpoint_ip - src_endpoint_hostname - src_endpoint_address - actor_user_name - user_agent - status_id - actor_user_domain silence: evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-20' ~~~ SELECT time, device_hostname, src_endpoint_ip, src_endpoint_hostname, src_endpoint_address, actor_user_name, user_agent FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_id = 1 AND (instr(',' || '{{attacker_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_hostname) || ',') > 0 OR instr(',' || '{{suspicious_ids}}' || ',', ',' || LOWER(src_endpoint_address) || ',') > 0 OR (LOWER(user_agent) LIKE '%windows 10 pro%' AND (actor_user_domain IS NULL OR actor_user_domain = '' OR actor_user_domain = '-'))) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-agent ```agent target=hunter cite: required context: - vulnerable-gateways - rare-vpn-user-agents - exploit-indicators max_iterations: 6 objective: Determine if any vulnerable PAN-OS gateway shows evidence of successful unauthorized VPN session establishment using exploit indicators. success_criteria: A verdict for each gateway citing the login rows that match exploit indicators or show rare user-agent patterns. tools: - endpoint - identity ``` ## route-on-verdict if~: "the triage-agent verdict is malicious for at least one gateway" (confidence: high, judge=hunter) then: → isolate-gateway indeterminate: → analyst-validation unavailable: → analyst-validation (blind_spot: missing-auth-telemetry) else: → analyst-validation ## isolate-gateway ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the affected PAN-OS gateway. Forcefully terminate all active VPN sessions and initiate a password reset for any accounts cited in the malicious findings. ``` → analyst-validation ## analyst-validation ```manual target=analyst Review the cited rows in hb_auth_signin. Confirm if the source IP or client hostname matches the report indicators. Search internal logs for subsequent auth attempts (RDP/SMB) from the compromised accounts. ``` → remediation-and-closeout ## remediation-and-closeout ```manual target=analyst Verify that all PAN-OS gateways have been updated to a version containing the fix for CVE-2026-0257. Document any false positives from the prevalence step for future tuning. ``` → end