Cybercrime Ring Leverages New GlobalProtect Flaw to Deploy AdaptixC2 Across Corporate Networks

A sophisticated threat campaign identified as “Operation Master” has been linked to the exploitation of a recently disclosed GlobalProtect VPN vulnerability (CVE-2026-0257), enabling attackers to install a bespoke command‑and‑control framework called AdaptixC2 inside enterprise environments.

The CVE targets Palo Alto Networks’ GlobalProtect client, allowing unauthenticated code execution when a specially crafted packet reaches the VPN gateway. Security analysts say the flaw provides a direct entry point for threat actors, bypassing traditional perimeter defenses that rely on VPN authentication.

Once inside a network, the operators of Operation Master employ a layered approach: they pivot through compromised web applications, harvest credentials, and use the stolen credentials to expand their foothold. The AdaptixC2 platform then orchestrates further malicious activity, ranging from data exfiltration to lateral movement across internal systems.

Beyond espionage, the group has built an industrial‑scale invoice‑fraud infrastructure. Stolen financial data is monetized through the automatic generation and submission of fraudulent invoices, a scheme that can siphon funds from targeted companies without immediate detection.

The campaign illustrates a growing trend where a single vulnerability serves as the seed for an end‑to‑end criminal operation, merging initial intrusion techniques with sophisticated monetization pipelines. Analysts caution that such hybrid models increase the difficulty of attribution and response.

Vendors have released patches for the GlobalProtect flaw, and cybersecurity firms are urging organizations to apply updates, enforce multi‑factor authentication, and monitor network traffic for signs of AdaptixC2 activity. Law enforcement agencies are reportedly reviewing the case as part of broader efforts to disrupt financially motivated cybercrime networks.