---
title: Hunt: after PAN-OS GlobalProtect CVE-2026-0257, ransomware crews pivot from the VPN to vCenter, turn off ESXi execInstalledOnly and dump domain credentials offline from the domain controller's VMDK | ctxsec
url: https://ctxsec.com/items/hunt-pan-os-0257-vcenter-esxi-vmdk-pivot
description: ""
status: "confirmed TTPs (Unit 42 threat brief update, Oct 19 4:00 PM PT) + hunt ideas"
published: 2026-10-20
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-pan-os-0257-vcenter-esxi-vmdk-pivot.md)

confirmed TTPs (Unit 42 threat brief update, Oct 19 4:00 PM PT) + hunt ideas

2026-10-20

### Hunt: after PAN-OS GlobalProtect CVE-2026-0257, ransomware crews pivot from the VPN to vCenter, turn off ESXi execInstalledOnly and dump domain credentials offline from the domain controller's VMDK

Unit 42's Oct 19 update to its CVE-2026-0257 brief describes what happens after the GlobalProtect auth bypass. Attackers start an MFA-less VPN session, do recon with dual-use RMM tools, move laterally over RDP/SMB, then stage credential theft, exfiltration and ransomware. Unit 42 says it has seen this since early June across education, finance, healthcare, government, manufacturing, utilities and other sectors. In its words, the biggest change is a "direct pivot to the virtualization layer": in one case the attackers went from the VPN gateway to the vCenter appliance, disabled the ESXi `execInstalledOnly` control, and used a custom tool to dump credentials offline from a domain controller's virtual disk, which never touches in-guest EDR. Unit 42 also saw the access chained with Veeam backup exploits (CVE-2023-27532).

1. **VPN to management plane:** list logins to vCenter (SSO/vpxd logs) and ESXi host clients whose source IPs are in the GlobalProtect pool. Admins rarely manage vCenter over user VPN, so each one needs a reason.
2. **execInstalledOnly:** on each host run `esxcli system settings kernel list -o execinstalledonly`. A Runtime value of FALSE where you expect TRUE, or a recent change in `/var/log/shell.log` or hostd logs, is a strong signal. Also check for SSH or ESXi Shell enabled outside change windows.
3. **DC disk access:** look for snapshot creation, datastore-browser downloads, clone or export tasks, or new VMs with a domain controller's VMDK attached, in vCenter tasks/events. Any read of a DC's disk outside your backup product should be treated as a domain-wide credential compromise.
4. **Veeam:** make sure Backup & Replication is patched for CVE-2023-27532 and port 9401 isn't reachable from VPN pools.
5. **Front door:** keep running the GlobalProtect placeholder host-ID/device-name hunts from our [Qilin/Inc item](/news#reliaquest-qilin-settra-0257).

If DC disk access is confirmed, plan a full AD recovery (krbtgt reset twice, then privileged and service accounts) rather than spot resets.

Sources: [Unit 42 threat brief, updated Oct 19](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) · [Palo Alto CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257) · [Broadcom: securing ESXi hosts (execInstalledOnly)](https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security/securing-esxi-hosts.html)