A patched firewall flaw is still an open door if you skipped the update
Arctic Wolf Labs reported on July 21, 2026 that it had investigated multiple intrusions during June 2026 in which attackers chained CVE-2026-0257, a PAN-OS authentication bypass rated CVSS 7.8, to gain a foothold. Palo Alto Networks has patched the flaw, which is exactly why the story lands now: the fix exists, and the intrusions happened anyway. Every one of those cases represents an organization that had a firewall running vulnerable PAN-OS at the moment an attacker came knocking. The vulnerability being fixed upstream does nothing for an appliance that never received the update.
Among the actors abusing this bypass are operators of the Qilin ransomware, one of the more active crews in the current landscape. An authentication bypass on a perimeter firewall is a high-value primitive because it converts an internet-facing security device into an entry point. Once past authentication, the attacker is inside the network boundary the firewall was purchased to defend. For engineering and security leaders, the uncomfortable takeaway is that the device enforcing your perimeter can become the mechanism that dissolves it when a known patch goes unapplied.
The tradecraft is consistent even when the outcome varies
What Arctic Wolf documented is a set of repeatable behaviors that defenders can hunt for. The lab noted that "Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion." The endgame differed case by case, but the path to it did not. That consistency is a gift to defenders, because repeatable patterns are detectable patterns. When an actor reuses the same staging and movement techniques across victims, a single well-built detection can catch many intrusions.
The lab was specific about those patterns: "Attackers demonstrated consistent operational patterns despite tradecraft variation: staging ransomware at C:\PerfLogs\, using PsExec for lateral execution via administrative shares." C:\PerfLogs\ is a legitimate Windows directory that rarely holds executables, which makes files appearing there a strong anomaly signal. PsExec over administrative shares is a classic lateral-movement technique that blends into environments where administrators use the same tooling. Distinguishing legitimate PsExec use from malicious use is where mature detection engineering earns its keep, and it is achievable with the right telemetry.
Qilin is scaling, and the numbers back it up
This is not an isolated campaign from a fading actor. Qilin claimed Kean University as a victim on July 24, 2026, and the group is competing with another operator known as The Gentlemen for the title of most prolific. That rivalry sits against a broader backdrop: ransomware activity rose roughly 20 percent year over year in the first half of 2026. The market for extortion is growing, and the leading operators are industrializing their approach rather than working case by case.
The Kean University claim illustrates a target profile worth noting. Education and public-sector institutions frequently run flat networks, stretched security teams, and slower patch cycles, which makes them attractive to actors who lead with a known firewall bypass. For PE-backed portfolio companies, the parallel is direct. Acquired businesses often carry inconsistent patching discipline and edge devices nobody has fully inventoried, and a growing, method-driven crew like Qilin is precisely the kind of adversary that finds those gaps first.
Turn the known tradecraft into concrete detections
Because the operational patterns are documented, defenders can act on them today. Alert on executable files written to C:\PerfLogs\, a location where they have no legitimate business appearing in most environments. Monitor PsExec usage and service creation over administrative shares, and baseline which hosts and accounts normally perform that activity so that deviations stand out. These detections do not depend on knowing which ransomware family is involved, which is what makes them durable against the tradecraft variation Arctic Wolf described.
On the exposure side, confirm that every PAN-OS device in your estate is patched against CVE-2026-0257 and review firewall logs for authentication anomalies during and after the June 2026 window. Given that active intrusions have already occurred, a clean patch status is necessary but not sufficient. Any appliance that was unpatched during that period warrants a threat hunt for the staging and lateral-movement indicators above, because the presence of the fix today says nothing about whether an attacker walked through before it was applied.
The roadmap implication for edge and endpoint owners
The through-line connecting this campaign is that perimeter devices and endpoint visibility have to be managed as one system. An authentication bypass on the firewall got Qilin in, and predictable endpoint tradecraft carried the attack to its conclusion. Weakness at either layer is enough to lose. That argues for tightening firewall patch SLAs to match the pace of exploitation and for ensuring endpoint detection actually covers the staging directories and lateral-movement tools that ransomware operators reuse across victims.
For leaders setting priorities, the practical sequence is inventory, patch, and hunt. Know every PAN-OS device you run and its firmware level, close the CVE-2026-0257 gap everywhere, and deploy the C:\PerfLogs\ and PsExec detections regardless of your current firewall status. With ransomware up roughly 20 percent year over year and organized crews like Qilin scaling their operations, the organizations that stay ahead will be the ones treating a patched vulnerability as a prompt to hunt rather than a reason to relax.
