Ransomware Gangs Qilin and Settra Exploit Old Palo Alto VPN Flaw After Patch

ReliaQuest, a cyber‑security monitoring firm, has disclosed that two ransomware collectives—Qilin and Settra—are actively leveraging a Palo Alto Networks VPN vulnerability that was patched several months ago.

The weakness, which affects the GlobalProtect remote‑access service, was publicly disclosed earlier this year and addressed in a May security update. While the patch sealed the flaw, many organizations have not yet applied the fix, leaving their remote‑access gateways exposed.

Both Qilin, a group associated with high‑value data exfiltration, and Settra, known for targeting healthcare and financial institutions, have been observed scanning for unpatched GlobalProtect deployments and delivering ransomware payloads. Their activity surfaced in recent threat‑intel feeds and was corroborated by ReliaQuest’s continuous monitoring platform.

Security analysts point out that ransomware operators frequently resurrect older exploits because defenders often assume that patched software is no longer a viable entry point. The reuse of a months‑old vulnerability highlights ongoing challenges in patch management, especially for large, geographically dispersed enterprises.

Palo Alto Networks issued a May advisory urging customers to upgrade to the latest GlobalProtect version and later provided additional hardening recommendations. The continued exploitation suggests that a notable share of organizations either missed the update or lack automated mechanisms to enforce timely patch deployment.

The episode underscores the importance of regular vulnerability assessments and verification of critical patch installations. As threat actors keep weaponizing known weaknesses, experts anticipate further attempts to exploit this same flaw until all lingering unpatched systems are secured.