A recent incident demonstrates how a vulnerability in a perimeter security appliance can become the first step in a much larger intrusion. This article examines the attack progression from PAN-OS GlobalProtect exploitation through credential theft, lateral movement, and eventual Qilin ransomware deployment, along with the published IoCs, attacker TTPs, and defensive recommendat