Ransomware crews target PAN-OS firewalls as Unit 42 investigates breaches

Key points

• Multiple ransomware gangs are targeting PAN-OS firewall systems.
• Unit 42 is examining network intrusions observed since June.
• Victims span numerous industries, and no CVE has been linked.
• Firewall hardening and close monitoring are urgent priorities.

Unit 42, the threat research team at Palo Alto Networks, is investigating a series of network compromises tied to attacks on the firewall operating system that runs PAN-OS devices. The activity has been underway since June and involves more than one ransomware operation, according to the available facts. As of Oct. 20, 2026, the investigation remains focused on how these intrusions unfolded across victim environments.

The affected organizations are not concentrated in a single sector. Numerous industries have encountered network compromises, which suggests the campaign is opportunistic rather than narrowly targeted. That breadth matters because perimeter firewalls sit at the boundary between untrusted networks and internal systems; a successful intrusion there can give an attacker a durable foothold for further access and ransomware deployment.

No CVE identifier has been associated with the activity in the facts provided. That absence is significant: defenders should not wait for a patch-centric trigger before reviewing exposure. Even without a named vulnerability, firewall appliances remain high-value targets because of their administrative access, VPN roles, and position in network trust relationships. Unit 42's involvement indicates the vendor is treating the pattern as a serious threat-intelligence matter.

What to watch: unusual administrative logins, configuration changes, new or modified firewall rules, unexpected VPN sessions, and outbound traffic from management interfaces. Organizations should compare current PAN-OS configurations against known-good baselines and follow vendor guidance closely. The key near-term question is whether the intrusions reflect credential abuse, exposed management access, or another weakness in how firewall systems are deployed and maintained.

What to do now

1. Inventory every internet-facing PAN-OS firewall and immediately restrict management access to trusted jump hosts or internal networks.
2. Enforce multi-factor authentication for all firewall administrators, rotate credentials, and remove dormant or shared accounts.
3. Review firewall and VPN configurations for risky rules, overly broad access, and unauthorized changes against a known-good baseline.
4. Apply the latest PAN-OS maintenance releases and follow Palo Alto Networks guidance even though no CVE has been assigned.
5. Centralize firewall logs and alert on anomalous admin logins, configuration edits, new VPN sessions, and unusual outbound traffic.
6. Segment firewall management from user and production networks, and limit administrative protocols to required sources only.
7. Export and securely store firewall configurations, test restoration procedures, and prepare an incident response plan for perimeter compromise.

Original source

The Register — Security