Loading story…
On October 3, 2025, threat intelligence firm GreyNoise detected a dramatic surge in scanning activity targeting Palo Alto Networks login portals, marking a nearly 500% increase in unique IP addresses involved compared to previous daily averages. This spike represented the highest level of such activity recorded in the past 90 days, with approximately 1,300 unique IP addresses participating in the scans, up from the typical 200. The vast majority of these IP addresses, about 93%, were classified as suspicious, while 7% were deemed malicious, indicating a significant threat level associated with the activity. Most of the scanning IPs were geolocated in the United States, but notable clusters also originated from the United Kingdom, the Netherlands, Canada, and Russia. The scanning was highly targeted, focusing on Palo Alto Networks login portals, including GlobalProtect and PAN-OS, and was primarily directed at emulated profiles set up by GreyNoise for monitoring purposes. Analysis revealed that the scanning activity was structured and likely derived from public internet scanning tools such as Shodan and Censys, or from attacker-originated reconnaissance efforts. Distinct clusters of scanning traffic were observed, with one group focusing on U.S.-based targets and another on Pakistan, each exhibiting unique but sometimes overlapping TLS fingerprints. The surge in Palo Alto scanning coincided with similar activity targeting Cisco ASA devices, with both sets of scans sharing regional clustering and fingerprinting overlaps, particularly a dominant TLS fingerprint linked to infrastructure in the Netherlands. GreyNoise noted that previous surges in scanning activity against Palo Alto technologies have sometimes preceded the disclosure of new vulnerabilities within six weeks, although not all such surges have led to new CVEs. The company referenced a similar incident in April 2025, which prompted Palo Alto Networks to urge customers to update their software. GreyNoise continues to monitor the situation closely, as such scanning activity can be an early indicator of forthcoming vulnerability disclosures or exploitation attempts. The targeted nature of the scans suggests that attackers may be seeking to identify vulnerable Palo Alto devices for potential compromise. The report underscores the importance for organizations using Palo Alto Networks products to ensure their systems are fully patched and to monitor for unusual login activity. The scanning activity's scale and coordination raise concerns about possible coordinated reconnaissance campaigns by threat actors. GreyNoise's research highlights the value of early warning signals in anticipating potential security incidents. The overlap in scanning techniques between Palo Alto and Cisco ASA devices may indicate shared attacker infrastructure or toolsets. Organizations are advised to block suspicious IPs identified in the scans and to review their exposure of management interfaces. The incident serves as a reminder of the persistent threat posed by automated and targeted internet scanning against critical network infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On October 3, 2025, GreyNoise publicly reported that scanning targeting Palo Alto Networks portals had surged over the prior 48 hours. The company described the activity as targeted and structured, noted similarities to recent Cisco ASA scanning, and advised organizations to run the latest software.
By October 3, 2025, GreyNoise observed a sharp spike in reconnaissance against Palo Alto Networks login portals, including GlobalProtect and PAN-OS profiles. The activity peaked at roughly 1,285 to 1,300 unique IPs, about 500% above normal levels, with most sources geolocated in the United States and the majority classified as suspicious or malicious.
On September 28, 2025, GreyNoise detected 110 unique malicious IPs attempting to exploit Grafana's path traversal flaw CVE-2021-43798. The activity was largely attributed to IPs geolocated in Bangladesh and primarily targeted systems in the United States, Slovakia, and Taiwan.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcethecyberthrone.in
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sudden and dramatic increase in malicious traffic targeting Palo Alto Networks' GlobalProtect portals was observed, with activity surging 40-fold within a 24-hour period starting November 14, 2025. Security researchers at GreyNoise recorded approximately 2.3 million sessions directed at the `global-protect/login.esp` endpoint, marking a 90-day high in scanning activity. The majority of this traffic originated from the AS200373 (3xK Tech GmbH) network, primarily geolocated in Germany and Canada, with a secondary contribution from AS208885. The scanning was broad, affecting systems in the US, Mexico, and Pakistan, and is believed to be opportunistic rather than targeted. GreyNoise analysts have identified recurring technical fingerprints and infrastructure linking this surge to previous campaigns, suggesting the involvement of the same threat actor(s). Historical patterns indicate that such spikes in scanning activity often precede the disclosure or exploitation of new vulnerabilities in the targeted vendor's products. Defenders are advised to monitor for further developments and consider blocking suspicious IPs using available threat intelligence solutions, as the risk of an imminent vulnerability disclosure or exploitation campaign remains elevated.
Jun 29, 2026
A coordinated cyberattack campaign has been identified targeting major networking devices from Cisco, Palo Alto Networks, and Fortinet, with evidence suggesting a single threat actor is orchestrating the activity. Security researchers at GreyNoise observed simultaneous scanning of Cisco ASA devices, increased login attempts against Palo Alto Networks portals, and brute-force attacks on Fortinet SSL VPNs, all originating from shared subnets and exhibiting recurring TCP fingerprints. This temporal and infrastructural correlation points to a sophisticated, cross-vendor campaign rather than opportunistic attacks. Experts note that adversaries are leveraging generative AI to automate these attacks, adopting tactics typically associated with nation-state actors. The campaign is notable for its focus on high-value targets such as networking devices and VPNs, which serve as critical gateways into enterprise networks and often possess privileged access that can bypass internal security controls. Industries such as manufacturing, industrials, and utilities are particularly at risk due to the potential for operational disruption and rapid financial gain for attackers. Concurrently, Cisco disclosed two zero-day vulnerabilities in its ASA and Secure Firewall Threat Defense software, identified as CVE-2025-20333 and CVE-2025-20362, which are being actively exploited in the wild. CVE-2025-20333 allows authenticated remote code execution due to improper input validation in the VPN web server, potentially granting attackers root-level access. CVE-2025-20362 is an authentication bypass flaw that enables remote attackers to access restricted endpoints without credentials. The combination of these vulnerabilities poses a severe risk, as attackers can gain full control of affected devices. Cisco’s Product Security Incident Response Team (PSIRT) has confirmed ongoing exploitation and is collaborating with government agencies to coordinate a response. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging all federal agencies to immediately mitigate exposure and assess for compromise. Over 90,000 Cisco FTD devices are reportedly exposed, highlighting the scale of the threat. Attackers are conducting large-scale scanning campaigns to identify vulnerable ASA login portals and entry points. Security experts emphasize the urgent need for organizations to inventory their Cisco ASA and FTD devices, apply available patches, and implement recommended mitigations. The campaign’s use of shared infrastructure and advanced automation underscores a shift in attacker methodology toward more efficient and targeted operations. The strategic targeting of network infrastructure devices reflects their critical role in enterprise security and the high impact of successful compromise. Organizations are advised to monitor for signs of compromise, follow vendor and government guidance, and prioritize remediation of affected systems. The ongoing nature of the attacks and the active exploitation of zero-day vulnerabilities make this a critical threat to enterprise and government networks worldwide.
Jun 29, 2026
A large-scale coordinated attack campaign targeted Palo Alto Networks GlobalProtect VPN portals and SonicWall SonicOS API endpoints in early December 2025. Over 7,000 IP addresses, primarily associated with the German hosting provider 3xK GmbH, were observed attempting to log into GlobalProtect portals and scanning SonicWall APIs. The activity was detected by threat intelligence firm GreyNoise, which noted that the same three client fingerprints used in this campaign had previously been seen in a separate wave of attacks between late September and mid-October, originating from different, typically non-malicious ASNs. The reuse of identical client fingerprints across different infrastructure and timeframes indicates a consistent set of tools and likely a single threat actor or group behind these campaigns. The attackers shifted their infrastructure but maintained the same attack patterns, focusing on credential-based attacks and brute-force attempts against remote access and API endpoints. This pattern highlights the ongoing risk to organizations using these technologies and the importance of monitoring for coordinated reconnaissance and credential abuse activity.
Jun 29, 2026