Ransomware groups are using an unpatched Palo Alto vulnerability to create unauthorized VPN sessions and access internal networks, despite fixes released months ago.
Ransomware groups Qilin and Settra are actively using an authentication bypass in Palo Alto Networks GlobalProtect to create stealthy, unauthorized VPN sessions.
Unit 42 links an Iranian-aligned campaign targeting Iraqi critical infrastructure to a complex chain involving trojanized code challenges and tunneling tools.