Qilin and INC Ransomware Groups Exploit Palo Alto Security Flaw

Summary: Palo Alto Networks announced that a security flaw affecting PAN-OS and Prisma Access, which allows bypassing multi-factor authentication (MFA), is being exploited by ransomware groups. Despite being patched, this vulnerability is still actively used.

In the cybersecurity landscape, vulnerabilities in critical infrastructure components always pose significant risks. A security flaw in Palo Alto Networks’ PAN-OS and Prisma Access products is being exploited by ransomware groups like Qilin and INC to bypass MFA. This situation indicates that even when patched, attackers quickly develop new methods and continue to exploit existing vulnerabilities.

The technical detail of this vulnerability likely relates to a logic error in authentication mechanisms or a session management flaw. Bypassing MFA allows attackers to gain access to systems even without valid credentials. Such vulnerabilities often stem from a gap in the authorization flow or a misconfiguration of an API endpoint.

For live systems and infrastructure operations, this situation re-emphasizes the critical importance of promptly applying security patches. Beyond patching, regular review of firewall rules and access control lists (ACL), monitoring for anomalous traffic patterns, and keeping endpoint security solutions up-to-date are necessary. Since MFA bypass means disabling one of the defense layers, strengthening other security controls is imperative.

Engineers must not only ensure that security products are up-to-date but also regularly audit their configurations and proactively search for potential vulnerabilities. Adopting zero-trust principles and verifying every access request can increase resilience against such attacks.

🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar