Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
CVE-2026-0257: Actively Exploited PAN-OS GlobalProtect Authentication Bypass Vulnerability
Malware Families
Excerpt
This issue affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists. Since October 19, Palo Alto’s Unit42 has observed ransomware groups leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session[2]. CVE CVE-2026-0257 Affected Products PAN-OS 12.1…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 104.207.144.154 | High | Score 79/100 | First seen |
| IP | 146.19.216.125 | High | Score 77/100 | First seen |
| IP | 179.43.172.213 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0257 | High | Score 81/100 | First seen |
| IP | 146.19.216.120 | High | Score 83/100 | First seen |
| IP | 23.128.228.6 | Medium | Score 62/100 | First seen |
| IP | 185.195.232.139 | High | Score 74/100 | First seen |
| IP | 146.19.216.119 | High | Score 81/100 | First seen |
| IP | 198.12.106.60 | Medium | Score 57/100 | First seen |
| IP | 202.144.192.47 | Medium | Score 57/100 | First seen |
IOC Relationship Graph
Building graph…