Item 2 in the brief for Tue, Oct 20

PAN-OS flaw used by Qilin and Inc ransomware groups, Unit 42 says

Unit 42 says ransomware operators, including the Qilin and Inc groups, have used a PAN-OS flaw, , to open VPN sessions into corporate networks, bypassing MFA. The flaw affects firewalls whose GlobalProtect portal or gateway uses authentication override cookies with a specific certificate setup, and Palo Alto Networks has released fixed versions. It has been in KEV since May 29.

Affected: PAN-OS 10.2, 11.1, 11.2 and 12.1 before each branch’s fixed hotfix or release, and Prisma Access until Palo Alto Networks upgrades it. All versions and fixes
CVE
Vendor: Palo Alto Networks
Published: Oct 20, 6:00 a.m. ET
Editor: Austin Simas

Details

GlobalProtect’s authentication override cookies let a user connect without signing in again while a cookie is valid. Palo Alto Networks classes the flaw as reliance on cookies without validation or integrity checks. It says an attacker can use it to bypass security restrictions and set up an unauthorized VPN connection. Its fix makes firewalls regenerate the cookies in a more secure way and check them strictly, so users must sign in once more after the upgrade.

Panorama and Cloud NGFW aren’t affected. Palo Alto Networks is upgrading Prisma Access on the schedule it shared with customers, but hybrid Prisma Access deployments must upgrade their own on-premises firewalls. It tells customers on older, unsupported PAN-OS versions to move to a supported fixed version. Unit 42’s investigations of the attacks since early June span industries including healthcare, government and manufacturing.

Unit 42 calls the Qilin group Spikey Scorpius and the Inc group Tarnished Scorpius. After getting in, Unit 42 says, the ransomware operators typically scout the network with remote monitoring and management tools and move laterally over RDP and Windows file sharing. They then stage tools to harvest credentials, steal data and deploy ransomware. Unit 42 also notes public reporting that attributes exploitation to attackers using Settra ransomware. CISA’s KEV catalog lists the flaw as known to be used in ransomware campaigns.

In one case, Unit 42 says, the attackers moved from the VPN gateway to the vCenter management appliance and turned off the execInstalledOnly protection on ESXi hosts. They then used a custom tool to dump credentials offline from a domain controller’s virtual disk, a method Unit 42 says gets around EDR inside the guest systems. Unit 42 has also seen the access chained with exploit tools for in Veeam Backup & Replication.

Unit 42 hasn’t said how many organizations it has seen hit or how many intrusions ended in ransomware. Palo Alto Networks’ advisory, last updated Jun 3, mentions only limited exploit attempts.

What to do

7 steps

1Search GlobalProtect logs for successful logins from the IP addresses in the indicators table, which Unit 42 ties to activity before the exploit went public on May 29.
2Search GlobalProtect logs for successful gateway-connected events from any address with suspicious host identifiers or device names such as aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT.
3Search GlobalProtect logs for successful gateway-connected events with the public exploit’s hard-coded values: endpoint_os_version set to Microsoft Windows 10 Pro 64-bit and an empty source_user_info.domain.
4Start incident response for any successful gateway-connected event that matches these indicators, as Unit 42 advises.
5Check whether each GlobalProtect portal and gateway is set to generate or accept cookies for authentication override, as only those are exposed.
6As a workaround, generate a new certificate used only for authentication override cookies, or turn off Authentication Override in the GlobalProtect portal and gateway settings.
7Upgrade every GlobalProtect portal and gateway that generates or accepts these cookies to a fixed version at the same time, including on-premises firewalls in hybrid Prisma Access setups.

Affected and fixed versions

Product	Affected	Fixed
PAN-OS 12.1	Before `12.1.4-h6`, and `12.1.5` through `12.1.6`	`12.1.4-h6`, or `12.1.7` or later
PAN-OS 11.2	Before `11.2.12`, except the fixed hotfixes	`11.2.4-h17`, `11.2.7-h14` or `11.2.10-h7` and later hotfixes of each, or `11.2.12` or later
PAN-OS 11.1	Before `11.1.15`, except the fixed hotfixes	`11.1.4-h33`, `11.1.6-h32`, `11.1.7-h6`, `11.1.10-h25` or `11.1.13-h5` and later hotfixes of each, or `11.1.15` or later
PAN-OS 10.2	Before `10.2.18-h6`, except the fixed hotfixes	`10.2.7-h34`, `10.2.10-h36`, `10.2.13-h21`, `10.2.16-h7` or `10.2.18-h6` and later hotfixes of each
Older, unsupported PAN-OS versions	Not fixed	Upgrade to a supported fixed version
Prisma Access 11.2	Before `11.2.7-h13`	`11.2.7-h13` or later, applied by Palo Alto Networks on its upgrade schedule
Prisma Access 10.2	Before `10.2.10-h36`	`10.2.10-h36` or later, applied by Palo Alto Networks on its upgrade schedule
Panorama and Cloud NGFW	Not affected	No action needed

Product
PAN-OS 12.1
Affected
Before 12.1.4-h6, and 12.1.5 through 12.1.6
Fixed
12.1.4-h6, or 12.1.7 or later
Product
PAN-OS 11.2
Affected
Before 11.2.12, except the fixed hotfixes
Fixed
11.2.4-h17, 11.2.7-h14 or 11.2.10-h7 and later hotfixes of each, or 11.2.12 or later
Product
PAN-OS 11.1
Affected
Before 11.1.15, except the fixed hotfixes
Fixed
11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25 or 11.1.13-h5 and later hotfixes of each, or 11.1.15 or later
Product
PAN-OS 10.2
Affected
Before 10.2.18-h6, except the fixed hotfixes
Fixed
10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later hotfixes of each
Product
Older, unsupported PAN-OS versions
Affected
Not fixed
Fixed
Upgrade to a supported fixed version
Product
Prisma Access 11.2
Affected
Before 11.2.7-h13
Fixed
11.2.7-h13 or later, applied by Palo Alto Networks on its upgrade schedule
Product
Prisma Access 10.2
Affected
Before 10.2.10-h36
Fixed
10.2.10-h36 or later, applied by Palo Alto Networks on its upgrade schedule
Product
Panorama and Cloud NGFW
Affected
Not affected
Fixed
No action needed

Indicators

IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42
IP address		Activity before the May 29 public exploit, per Unit 42

IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42
IP addressActivity before the May 29 public exploit, per Unit 42

Timeline

May 13Palo Alto Networks discloses the flaw.
May 29Exploit code for the flaw becomes public, Unit 42 says.
May 29CISA adds the flaw to KEV.
Oct 19Unit 42 updates its threat brief to name ransomware groups exploiting the flaw.

Sources

Unit 42Primary source unit42.paloaltonetworks.com
Palo Alto Networks security advisoryPrimary source security.paloaltonetworks.com
CISA KEV catalogPrimary source cisa.gov