developing↓ De-escalatingCyber

Qilin Ransomware Activity Escalates with PAN-OS Exploitation and Increased Attacks

The Qilin ransomware group has escalated its activity, leading global cyber incidents with 24 claimed attacks for the week of July 15-21, 2026, primarily targeting US government and military sectors.

Impact

7.8

Confidence

Medium-High

Evidence

2 sig · 2 src

Trajectory

↓ De-escalating

Geo

First seen Jul 21·Updated Jul 23·Synthesized Jul 23

Export brief

Assessment

Medium-High confidence — 2/2 signals corroborated across 2 independent sources

The Qilin ransomware group has escalated its activity, leading global cyber incidents with 24 claimed attacks for the week of July 15-21, 2026, primarily targeting US government and military sectors. This increased activity is concurrent with confirmed exploitation of a critical Palo Alto Networks PAN-OS authentication bypass vulnerability to gain network access. The total volume of compromised data is claimed to be 29.6 TB, though attribution relies on self-reported claims.

Why it matters — The exploitation of a critical VPN vulnerability combined with increased attack volume represents a significant threat to enterprise and government infrastructure.

Established

·Confirmed: Qilin ransomware group is actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks' GlobalProtect VPN.
·Confirmed: Global cyber activity reached 350 incidents across 58 countries for the week of July 15-21, 2026.
·Claimed: Qilin ransomware group led global cyber activity with 24 attacks for the week of July 15-21, 2026.
·Claimed: Qilin contributed to 29.6 TB of compromised data.
·Claimed: US government and military sectors remain primary targets.
·Unclear: The specific scope of victim impact from the PAN-OS exploitation remains unquantified.

Indicators to watch

→Further details on the scope and impact of PAN-OS vulnerability exploitation by Qilin.
→Official attribution of data breaches to Qilin beyond self-reported claims.
→Defensive actions or patches released by Palo Alto Networks and adoption rates.

Evidence

Confirmed · 2 independent sources · 2 signals · 2 independent sources

Central claim — Qilin ransomware group leads global cyber activity with 24 claimed attacks for week of July 15-21, 202650% on claim

Corroborated1 · 1 src · best low 46%

Jul 21Qilin ransomware group leads global cyber activity with 24 claimed attacks for week of July 15-21, 2026Hackmanac Cyber News · T3

Context1 · 1 src · best low 54%— related coverage — does not support the central claim

Jul 21Qilin ransomware group exploiting critical Palo Alto Networks PAN-OS authentication bypassBleepingComputer · T3

Topics cybersecurity · ransomware · qilin · data-breach · threat-intelligence · vulnerability · vpn

Discussion

…