Kaspersky Q3 2026 Non-Mobile Threat Landscape: Qilin Ransomware via CVE-2026-0257, INC Ransom via SonicWall SMA1000 CVE-2026-15409/15410, macOS Stealers (PamStealer, MacSync, Overlord) and npm/PyPI/crates.io Supply-Chain Backdoors

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5627 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Qilin CVE-2026-0257 PAN-OS GlobalProtect Access From Kali-Named Host or Known Source IP

Behaviour-first search for GlobalProtect portal/gateway sessions where the client machine name starts with 'kali' or the public IP matches Arctic Wolf-reported infrastructure used while exploiting CVE-2026-0257 (PAN-OS authentication bypass) for Qilin ransomware initial access (TL-2026-5627).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1133
• Data sources: pan_globalprotect, pan:globalprotect, palo_alto_vpn_logs
• Severity: high
• Confidence: high

Splunk SPL

index=pan_logs sourcetype="pan:globalprotect" earliest=-24h
| eval gp_host=coalesce(machine_name, machinename, host_name, src_host), gp_src=coalesce(public_ip, src_ip), gp_user=coalesce(user, srcuser, src_user)
| where match(lower(coalesce(gp_host,"")), "^kali") OR in(gp_src, "108.61.229.217","108.61.75.232","2.188.33.52","199.247.22.193","70.34.205.43")
| stats count min(_time) as first_seen max(_time) as last_seen values(gp_user) as users values(gp_host) as gp_hosts values(dest) as gateways by gp_src
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let gp_ioc_ips = dynamic(["108.61.229.217","108.61.75.232","2.188.33.52","199.247.22.193","70.34.205.43"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Palo Alto Networks"
| where DeviceEventClassID has "globalprotect" or Activity has "globalprotect" or DeviceProduct has "GlobalProtect"
| extend MachineName = extract(@"(?i)(?:machinename|srchostname|hostname)=([^;\s]+)", 1, AdditionalExtensions)
| where MachineName startswith "kali" or SourceIP in (gp_ioc_ips)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Users=make_set(SourceUserName, 20), Hosts=make_set(MachineName, 20) by SourceIP, DeviceName

Sigma

title: PAN-OS GlobalProtect VPN Session From Kali-Named Host or Qilin CVE-2026-0257 Source IP
id: 3f1a9c52-7b0e-4d1a-9a63-562700000001
status: experimental
description: Detects GlobalProtect VPN sessions established from a host named kali* or from public IPs reported by Arctic Wolf during CVE-2026-0257 authentication-bypass exploitation preceding Qilin ransomware deployment.
references:
    - https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/
    - https://securelist.com/malware-report-q3-2026-pc-iot-statistics/121843/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1133
    - cve.2026-0257
    - detection.emerging-threats
logsource:
    product: paloalto
    service: globalprotect
detection:
    selection_host:
        machinename|startswith: 'kali'
    selection_ioc:
        public_ip:
            - '108.61.229.217'
            - '108.61.75.232'
            - '2.188.33.52'
            - '199.247.22.193'
            - '70.34.205.43'
    condition: 1 of selection_*
falsepositives:
    - Authorised red team or penetration tester connecting from a Kali-named host
    - Security staff lab VPN access
level: high

Known false positives:

• Authorised penetration testers or red team operators using a Kali VM over VPN
• Employees with personal Linux VMs that report a Kali hostname

Tuning notes: Confirm field names (machine_name/public_ip) against your Palo Alto TA version. Add approved red-team source IPs to an allowlist lookup. Extend the IP list from research IOCs as new Arctic Wolf data lands. Correlate hits with subsequent internal RDP/PsExec activity.

• 🔒 SonicWall SMA1000 CVE-2026-15409/15410 Exploitation Chain (wsproxy to rollbackConfirm) · unlock with TL Creds
• 🔒 Qilin Windows Persistence, Defense Evasion and Impact (MeshUserTask, Run keys, log clearing, PerfLogs payload) · unlock with TL Creds
• 🔒 Qilin Lateral Movement, Exfiltration and Remote-Access Tooling (PsExec, Rclone MEGA, Ngrok, MeshAgent, AnyDesk) · unlock with TL Creds
• 🔒 Supply-Chain Malicious Package Execution ([indicator], [indicator], MemTensor/[indicator]) · unlock with TL Creds
• 🔒 macOS Stealer Persistence via Apple-Lookalike LaunchAgent and Fake Finder Bundle · unlock with TL Creds
• 🔒 SonicWall SMA1000 Implants: ROOTRUN xzfind, KNUCKLEBALL, Suo5 Tunnel and ORANGETAIL Web Shell · unlock with TL Creds
• 🔒 Qilin Post-Exploitation Credential Dumping (LSASS comsvcs MiniDump, NTDS ntdsutil IFM) · unlock with TL Creds
• 🔒 C2 Domain Resolution: Overlord, PamStealer, MacSync, sckit ([indicator]) and INC Ransom Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 42 indicators of compromise for TL-2026-5627.

Sample indicators (3 of 42)

• IP address: 108.61.229[.]217
• Domain: helprans[.]com
• File hash: 81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2

Defanged, TLP:CLEAR. Full set of 42 indicators: unlock with TL Creds.

Community OSINT corroboration

6 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Securelist's Q3 2026 non-mobile report (published 2026-11-10) aggregates Kaspersky telemetry: 311,083,655 web attacks blocked, 46,936,926 unique malicious URLs, 23,733,652 malicious or unwanted objects detected by File Anti-Virus, 81,556 unique users attacked by ransomware and 217,024 by miners. Kaspersky counted 4,470 new ransomware variants and 3 new families. By share of leak-site victims Qilin led with 15.39%, followed by The Gentlemen (7.89%) and Deadlock (4.46%). The most-attacked-user families were Trojan-Ransom.Win32.Gen (32.48%), Crypren (6.31%) and WannaCry (4.90%). Law-enforcement outcomes included a 16-year sentence for the Ransom Cartel creator (August), a two-year sentence for a Ryuk member (about 1,610 BTC in ransom received) and a four-year sentence for a Conti member (September).

Edge-device exploitation was a key initial-access theme. Arctic Wolf documented Qilin intrusions in June 2026 that abused CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway (CVSS 7.8 per Arctic Wolf) to establish VPN sessions from hosts named 'kali'. The operators then persisted with Run keys, a scheduled task (\MeshUserTask) and remote-access tools (AnyDesk, Ngrok, LogMeIn, MeshAgent), dumped LSASS via comsvcs.dll MiniDump and NTDS via ntdsutil IFM, moved laterally with PsExec and RDP, cleared event logs, exfiltrated with Rclone to MEGA, targeted Veeam, and ran the Qilin payload C:\PerfLogs\win.exe. Resecurity documented the SonicWall SMA1000 chain: CVE-2026-15409 (CVSS 10.0, pre-auth /wsproxy bypass reaching CouchDB/Erlang on localhost:1050 and ctrl-service on 8188) chained with CVE-2026-15410 (CVSS 7.2, path traversal in remove_hotfix via POST /rollbackConfirm.action) for root, followed by the ROOTRUN, KNUCKLEBALL, Suo5 and ORANGETAIL implants. Volexity tracks pre-disclosure exploitation (from 2026-06-22) as UTA0533; SonicWall patched on 2026-07-14 and CISA added both CVEs to KEV. Researchers link the activity to INC Ransom, but CISA does not name a group. The report also lists CVE-2026-45659 (SharePoint, authenticated RCE), CVE-2025-60710 (Windows LPE), CVE-2026-59310 (VMware vCenter, unauthenticated RCE), CVE-2025-14733 (WatchGuard Firebox, unauthenticated RCE) and CVE-2026-63077 (TeamCity auth bypass via the agent polling protocol); the report names no actors for these.

On macOS, Jamf reported PamStealer (2026-07-02), a two-stage AppleScript/JXA dropper plus Rust Mach-O stealer masquerading as the Maccy clipboard manager that validates stolen admin passwords through PAM, and Overlord (2026-08-06), a configured build of the open-source Overlord RAT delivered by a .NET 10 fake Zoom installer with C2 at hub.zoom.com.kg:5173. Kaspersky's own MacSync analysis (2026-09-24) describes a MaaS crypto stealer plus backdoor with a six-stage chain, iCloud-calendar payload staging, Curve25519/AES-GCM key exchange, LaunchAgent, .zshrc and Git-hook persistence, and PAM password verification. Amos detections rose, and Ngrok topped the macOS detection list.

Socket documented three supply-chain compromises: the jscrambler npm package (malicious 8.14.0 published 2026-07-11, plus 8.16.0, 8.17.0, 8.18.0 and 8.20.0) delivering a Rust infostealer targeting wallets, cloud credentials and AI-agent/MCP configuration files; the arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 crates (2026-08-20) which pulled the malicious proc-macro1 dependency whose build.rs fetched a backdoor from 23.254.165.112; and MemTensor's @memtensor/memos-cloud-openclaw-plugin and PyPI MemoryOS 2.0.34 (2026-09-23) delivering a Go credential-stealing 'sckit' binary with C2 under skyleen.fr. No CVSS applies to the aggregate report.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS; T1056.001 Input Capture: Keylogging

Discovery

T1018 Remote System Discovery

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1505.003 Server Software Component: Web Shell; T1543.001 Create or Modify System Process: Launch Agent; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.002 Command and Scripting Interpreter: AppleScript; T1204.002 User Execution: Malicious File; T1569.002 System Services: Service Execution

Collection

T1113 Screen Capture

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Command and Control

T1219 Remote Access Tools; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1572 Protocol Tunneling

Impact

T1490 Inhibit System Recovery

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation

Patches

• Palo Alto Networks PAN-OS fixed releases for CVE-2026-0257 (e.g. 12.1.4-h6, 11.2.4-h17, 11.1.4-h33, 10.2.7-h34 per Arctic Wolf)
• SonicWall SNWLID-2026-0008 (published 2026-07-14) for CVE-2026-15409 and CVE-2026-15410
• Vendor patches for CVE-2026-45659, CVE-2025-60710, CVE-2026-59310, CVE-2025-14733 and CVE-2026-63077

Immediate actions

• Patch PAN-OS GlobalProtect against CVE-2026-0257 and review VPN logs for sessions from hosts named 'kali'
• Upgrade SonicWall SMA1000 to 12.4.3-03453 or later / 12.5.0-02835 or later (SNWLID-2026-0008) and hunt for /usr/bin/xzfind, /tmp/agent_wp8.jar, /tmp/agent_wp9.jar and unexpected setuid binaries
• Remove malicious packages: jscrambler 8.14.0/8.16.0/8.17.0/8.18.0/8.20.0 (pin 8.22.0), arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, @memtensor/memos-cloud-openclaw-plugin 0.1.21/0.1.23/0.1.25, MemoryOS 2.0.34
• Rotate all credentials, API keys, publish tokens and MCP/AI-agent secrets reachable from any host that installed or built the affected packages
• Block skyleen.fr, 23.254.165.112, hub.zoom.com.kg, avenger-sync.live and the MacSync domains at DNS/proxy

Workarounds

• Pin arrayref <= 0.3.9, internment <= 0.8.6, append-only-vec <= 0.1.8
• Pin MemTensor npm plugin to 0.1.20 and MemoryOS to 2.0.33
• Run npm with --ignore-scripts is NOT sufficient for jscrambler 8.18.0+ (dropper runs on import); pin to a clean version instead

Longer-term hardening

• Restrict and monitor remote-access tooling (AnyDesk, Ngrok, LogMeIn, MeshAgent, Rclone) in enterprise environments
• Protect Veeam and other backup infrastructure with network isolation and MFA
• Use lockfiles, dependency allow-listing and install-script controls (including build.rs and preinstall hooks) in CI/CD
• Alert on macOS Script Editor spawning codesign, fake Finder processes in Application Support, and LaunchAgents with Apple-lookalike labels

Affected and fixed versions

• Palo Alto Networks — PAN-OS GlobalProtect / Prisma Access
  Vulnerable versions: 12.1 before 12.1.4-h6 or 12.1.7; 11.2 before 11.2.4-h17; 11.1 before 11.1.4-h33; 10.2 before 10.2.7-h34; Prisma Access 10.2.0-10.2.10-h35 and 11.2.0-11.2.7-h12
  Fixed in: 12.1.4-h6; 11.2.4-h17; 11.1.4-h33; 10.2.7-h34
• SonicWall — SMA1000 (SMA 6210, 7210, 8200v, CMS)
  Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
  Fixed in: 12.4.3-03453 and later; 12.5.0-02835 and later
• Microsoft — SharePoint Server / Windows
  Vulnerable versions: CVE-2026-45659; CVE-2025-60710
• VMware — vCenter Server
  Vulnerable versions: CVE-2026-59310
• WatchGuard — Firebox
  Vulnerable versions: CVE-2025-14733
• JetBrains — TeamCity
  Vulnerable versions: CVE-2026-63077
• npm / crates.io / PyPI — jscrambler, arrayref, internment, append-only-vec, @memtensor/memos-cloud-openclaw-plugin, MemoryOS
  Vulnerable versions: jscrambler 8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0; arrayref 0.3.10; internment 0.8.7; append-only-vec 0.1.9; @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, 0.1.25; MemoryOS 2.0.34
  Fixed in: jscrambler 8.22.0; arrayref <= 0.3.9; internment <= 0.8.6; append-only-vec <= 0.1.8; plugin 0.1.20; MemoryOS 2.0.33

Timeline

• 2026-06-02 locked-ioc-31, a domain tied to INC Ransom victim-contact activity, is registered per WHOIS cited by Resecurity.
• 2026-06-04 Arctic Wolf issues a bulletin on exploitation of PAN-OS CVE-2026-0257; a second bulletin on increased exploitation follows on 2026-06-11 as Qilin intrusions are investigated.
• 2026-06-22 Volexity-observed pre-disclosure exploitation (UTA0533) of SonicWall SMA1000 begins; ROOTRUN is first written to an appliance.
• 2026-07-02 Jamf Threat Labs publishes PamStealer, a macOS stealer using PAM to validate captured admin passwords.
• 2026-07-11 Malicious jscrambler@8.14.0 is published to npm with a Rust infostealer; Socket flags it six minutes later, and further malicious versions follow within about three hours.
• 2026-07-14 SonicWall releases SNWLID-2026-0008 patches for CVE-2026-15409/15410 and CISA adds both CVEs to the KEV catalog.
• 2026-07-20 Arctic Wolf publishes its analysis linking CVE-2026-0257 exploitation to Qilin ransomware deployment.
• 2026-08-06 Jamf reports a fake Zoom installer delivering the Overlord RAT on macOS with C2 at locked-ioc-23:5173.
• 2026-08-20 Rust crates arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 are republished with the malicious proc-macro1 dependency; Rust Security Response removes them and locks the maintainer account.
• 2026-09-23 Malicious @memtensor/memos-cloud-openclaw-plugin 0.1.21/0.1.23/0.1.25 and MemoryOS 2.0.34 are published, delivering the Go 'sckit' credential stealer.
• 2026-09-24 Kaspersky publishes its MacSync analysis describing the new binary-dropper chain, PAM-based password theft and Finder-masquerading backdoor.
• 2026-11-10 Securelist publishes the Q3 2026 non-mobile statistics report: 4,470 new ransomware variants, 3 new families, Qilin at 15.39% of leak-site victims.

Sources cited

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-07-14
• IT threat evolution in Q3 2026. Non-mobile statistics Kaspersky Securelist · Research · 2026-11-10
• Exploitation of CVE-2026-0257 leads to Qilin ransomware (Arctic Wolf) arcticwolf.com · Vendor report · 2026-07-20
• From WSProxy to ROOT: INC ransomware and SonicWall SMA exploit chain (Resecurity) resecurity.com · Vendor report · 2026-08-01
• PamStealer macOS infostealer: AppleScript and Rust (Jamf Threat Labs) jamf.com · Vendor report · 2026-07-02
• Fake Zoom installer delivers Overlord RAT on macOS (Jamf Threat Labs) jamf.com · Vendor report · 2026-08-06
• MacSync new version (Securelist) Kaspersky Securelist · Research · 2026-09-24
• Jscrambler supply-chain attack (Socket) socket.dev · Blog · 2026-07-11
• Popular Rust crates compromised (Socket) socket.dev · Blog · 2026-08-20
• MemTensor compromise (Socket) socket.dev · Blog · 2026-09-23
• Ransom Cartel ransomware creator sentenced to 16 years in prison (BleepingComputer) BleepingComputer · News · 2026-08-01
• Ryuk ransomware member sentenced to 24 months in prison (BleepingComputer) BleepingComputer · News · 2026-09-01
• Conti ransomware gang member sentenced to four years in prison (BleepingComputer) BleepingComputer · News · 2026-09-01

More in malware

• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America
• GhostFrame: New ESXi Post-Exploitation Implant Linked to TAG-218 / Settra Ransomware
• Formbook (XLoader) Campaign Targets European Manufacturing and Technology Businesses with Localized Order Lures
• iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft
• Kaspersky Q3 2026 Mobile Threat Statistics: Mamont/Creduz banker droppers, Triada/Vo1d preinstalled malware, AI-assisted Android fraud, DarkSword iOS exploit kit

More from Qilin

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Qilin (Agenda) Ransomware: ESXi/vCenter Targeting, Affiliate Networks and Double Extortion
• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate

Other reports on CVE-2026-0257

• October 21 Roundup: PHP2Shell (CVE-2026-109618/109619), LiteLLM 1.107.0 Supply-Chain Backdoor, Palo Alto GlobalProtect CVE-2026-0257 Exploitation
• k0t (CryptoFeel / Scrooge) Network-Edge Intrusion Campaign Targeting FortiGate, FortiWeb and GlobalProtect (CVE-2025-64446, CVE-2026-0257)
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
• PAN-OS GlobalProtect/Prisma Access Authentication Bypass CVE-2026-0257 Exploited by Qilin and Settra Ransomware (ThreatsDay Bulletin: SiteGuard WAF CVE-2026-106931, Adobe AEM RCE Chain, Noir Wallet Drainer)
• CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce Platforms
• Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany; Qilin Affiliate Exploited Check Point VPN Zero-Day CVE-2026-50751

Other reports on CVE-2026-15409

• CTO at NCSC Weekly Summary (week ending July 26, 2026): Cl0p PTC Windchill/FlexPLM exploitation (CVE-2026-12569), SonicWall SMA 1000 zero-days (CVE-2026-15409/CVE-2026-15410), and multi-actor state-linked activity
• Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and Criminal Exploitation of Perimeter Devices
• Sophos X-Ops: Attackers Impersonate Claude, ChatGPT, Copilot and Perplexity to Distribute Infostealers, Backdoors and Malicious Browser Extensions
• QuoIntelligence Weekly Snapshot W32 2026: DOUBLECUP ClickFix loader, UTA0533 SonicWall SMA1000 zero-day chain (CVE-2026-15409/15410), Greatness AiTM/device-code PhaaS, EtherRAT blockchain C2
• SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware Precursor

Previous and next in malware

• RevStealer (REF2859) Infostealer Spread via 100+ Domains, Hijacked YouTube Channels and Fake AI/Cheat Tools Previous report

Further reading

• npm Supply Chain Attacks 2026: 218 Packages
• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors