Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
Palo Alto Warns of Actively Exploited GlobalProtect VPN Vulnerability
Excerpt
Palo Alto Networks Unit 42 has confirmed active exploitation of CVE-2026-0257 , a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software. The flaw allows remote unauthenticated attackers to forge authentication override cookies and establish unauthorized VPN connections without ever providing valid credentials. The vulnerability was originally assigned a CVSSv4 score of 4.7 (medium), but following confirmed…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 104.207.144.154 | High | Score 79/100 | First seen |
| IP | 146.19.216.125 | High | Score 77/100 | First seen |
| IP | 209.99.191.137 | High | Score 58/100 | First seen |
| IP | 179.43.172.213 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0257 | High | Score 81/100 | First seen |
| IP | 146.19.216.120 | High | Score 83/100 | First seen |
| IP | 23.128.228.6 | Medium | Score 62/100 | First seen |
| IP | 79.130.26.202 | Low | Score 30/100 | First seen |
| IP | 185.195.232.139 | High | Score 74/100 | First seen |
| IP | 146.19.216.119 | High | Score 81/100 | First seen |
| IP | 198.12.106.60 | Medium | Score 57/100 | First seen |
| IP | 202.144.192.47 | Medium | Score 57/100 | First seen |
IOC Relationship Graph
Building graph…