Unit 42's Oct 19 update to its CVE-2026-0257 brief describes what happens after the GlobalProtect auth bypass. Attackers start an MFA-less VPN session, do recon with dual-use RMM tools, move laterally over RDP/SMB, then stage credential theft, exfiltration and ransomware. Unit 42 says it has seen this since early June across education, finance, healthcare, government, manufacturing, utilities and other sectors. In its words, the biggest change is a "direct pivot to the virtualization layer": in one case the attackers went from the VPN gateway to the vCenter appliance, disabled the ESXi execInstalledOnly control, and used a custom tool to dump credentials offline from a domain controller's virtual disk, which never touches in-guest EDR. Unit 42 also saw the access chained with Veeam backup exploits (CVE-2023-27532).

1. VPN to management plane: list logins to vCenter (SSO/vpxd logs) and ESXi host clients whose source IPs are in the GlobalProtect pool. Admins rarely manage vCenter over user VPN, so each one needs a reason.
2. execInstalledOnly: on each host run esxcli system settings kernel list -o execinstalledonly. A Runtime value of FALSE where you expect TRUE, or a recent change in /var/log/shell.log or hostd logs, is a strong signal. Also check for SSH or ESXi Shell enabled outside change windows.
3. DC disk access: look for snapshot creation, datastore-browser downloads, clone or export tasks, or new VMs with a domain controller's VMDK attached, in vCenter tasks/events. Any read of a DC's disk outside your backup product should be treated as a domain-wide credential compromise.
4. Veeam: make sure Backup & Replication is patched for CVE-2023-27532 and port 9401 isn't reachable from VPN pools.
5. Front door: keep running the GlobalProtect placeholder host-ID/device-name hunts from our Qilin/Inc item.

If DC disk access is confirmed, plan a full AD recovery (krbtgt reset twice, then privileged and service accounts) rather than spot resets.