Qilin and INC Reportedly Exploit Palo Alto Flaw to Bypass MFA

Reporting links Qilin and INC ransomware activity to exploitation of a Palo Alto Networks GlobalProtect/PAN-OS authentication-bypass flaw; the flaw was reportedly patched in May. Post-access leads include Cobalt Strike, BloodHound/SharpHound, pivots to vCenter/ESXi, offline credential dumping from a domain controller VMDK, and Veeam targeting; validate the CVE and campaign details against primary sources.