Ransomware gangs have exploited a Palo Alto firewall flaw since June

[RomanReigns02]

Multiple ransomware groups have been exploiting a flaw in Palo Alto Networks firewalls for months. The Register's Jessica Lyons reports that the bug affects the GlobalProtect portals and gateways in PAN-OS, letting attackers get past login checks and open unauthorised VPN connections

The timeline is worrying. Palo Alto patched the flaw on 13 May and initially rated it as medium severity. Rapid7 later found successful exploitation dating back to at least 17 May, and Palo Alto's own Unit 42 team has been investigating attacks since early June

Unit 42 says the Qilin and Inc ransomware groups are using the bug, and ReliaQuest names Settra operators as well. Attackers bypass multi factor authentication, move around networks using remote desktop and file sharing protocols, steal credentials and data, and then deploy ransomware

In one case, attackers moved from the network to vCenter and ESXi servers and dumped credentials from a domain controller's virtual disk. The bug has also been chained with an older Veeam flaw. Victims include organisations in education, finance, healthcare and government

A medium severity rating for a flaw that ends up powering ransomware campaigns shows how hard it is to judge risk at the time of release. Organisations that delayed patching because the rating looked low have paid the price. Firewalls and VPNs remain one of the most targeted parts of any network

Should vendors be more cautious with severity ratings? And how quickly does your organisation patch edge devices?

Palo Altowww.theregister.com