Topic
Palo Alto Networks
How AI Powers NGFW Solutions in 2026: Russian Vendors and Global Approaches Compared
AI Security
Unit 42 Details First Multi-Agent AI Ransomware Attack That Finished in Ten Hours
AI Security
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Malware & BotnetsWhy Automation Alone Fails to Improve SOC Efficiency: The Case for Managed Operational Models
Mature security infrastructure does not guarantee protection against cyber threats, as attacks can still cause downtime, crisis recovery, and financial damage even when key controls are deployed. Automation of routine tasks helps speed up responses but cannot raise SOC effectiveness without clear decision criteria, defined responsibilities, and repeatable incident-handling processes. Organizations using an average of 83 security tools from 29 vendors face fragmentation that automation alone cannot resolve. A managed SecOps model covering the full incident lifecycle—from detection and prioritization through investigation, response, closure, and post-incident improvement—is required. Positive Technologies highlights that SecOps platforms such as MaxPatrol 360 provide the unified environment needed to link context, processes, coordination, automation, metrics, and continuous improvement.
Qilin Ransomware Operators Exploit Palo Alto PAN-OS VPN Flaw CVE-2026-0257
Operators linked to the Qilin ransomware group have been actively exploiting an authentication bypass vulnerability in Palo Alto Networks PAN-OS to gain initial access to corporate networks. The attacks, observed in June 2026, targeted the GlobalProtect VPN service running on Palo Alto firewalls and were tracked under CVE-2026-0257. Attackers used specially crafted authentication cookies to establish unauthorized VPN sessions, after which they harvested credentials from Windows LSASS processes and Active Directory NTDS databases. Lateral movement relied heavily on PsExec and administrative shares, supplemented by tools such as AnyDesk, Ngrok, LogMeIn, and NetExec. Before deploying the ransomware binary stored as win.exe in C:\PerfLogs\, the threat actors disabled Microsoft Defender real-time protection and cleared event logs. The vulnerability affects PAN-OS versions 10.2, 11.1, 11.2, and 12.1 as well as certain Prisma Access editions, while Panorama and Cloud NGFW remain unaffected.