CyberSecurity News
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
AI summary
Palo Alto Networks has reported that ransomware groups are exploiting a previously patched security vulnerability to bypass multi-factor authentication. The flaw, which has a CVSS score of 7.8, affects PAN-OS and Prisma Access, and can be used to establish unauthorized VPN connections. The issue was patched by Palo Alto Networks in May 2026. Ransomware actors, including Qilin and INC groups, are taking advantage of this vulnerability. The company is continuing to observe exploitation of this flaw.
Vulnerabilities mentioned
Threat groups mentioned
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.