PAN-OS Cookie Bypass Fuels Qilin Ransomware While DNS TXT Records Power Noir Wallet Drainer

ReliaQuest telemetry shows sessions originating through organizational VPNs now carrying hostnames such as 'kali' after the May 2026 disclosure. The same pattern appears in Infoblox reporting on the Noir drainer, which resolves active backend pools through public DoH queries to Cloudflare Pages TXT records before requesting limited spending permissions. Both cases demonstrate how minimal initial access escalates without triggering standard alerts.

Group-IB documentation on KGB RAT reveals an additional layer: the malware combines HVNC, credential theft, and psychological harassment modules delivered through a crypter that has remained undetected since late 2025 underground marketing. This aligns with the Discord C2 observed in Darktrace's CikaBika Bot samples using Nim loaders and DLL hijacking. The common thread is abuse of trusted channels—VPN cookies, DNS resolution, and chat platforms—rather than novel zero-days.

Procurement records and incident timelines indicate defenders continue to prioritize patching over session termination and permission scoping. The result is persistent pre-patch access that ransomware groups monetize before remediation completes.

Expect increased use of AI-assisted malware builders to rotate C2 infrastructure faster than signature updates. Organizations must enforce mandatory session termination after every GlobalProtect patch cycle and monitor for anomalous DoH resolutions tied to cryptocurrency permissions.