Loading story…
A sudden and dramatic increase in malicious traffic targeting Palo Alto Networks' GlobalProtect portals was observed, with activity surging 40-fold within a 24-hour period starting November 14, 2025. Security researchers at GreyNoise recorded approximately 2.3 million sessions directed at the global-protect/login.esp endpoint, marking a 90-day high in scanning activity. The majority of this traffic originated from the AS200373 (3xK Tech GmbH) network, primarily geolocated in Germany and Canada, with a secondary contribution from AS208885. The scanning was broad, affecting systems in the US, Mexico, and Pakistan, and is believed to be opportunistic rather than targeted.
GreyNoise analysts have identified recurring technical fingerprints and infrastructure linking this surge to previous campaigns, suggesting the involvement of the same threat actor(s). Historical patterns indicate that such spikes in scanning activity often precede the disclosure or exploitation of new vulnerabilities in the targeted vendor's products. Defenders are advised to monitor for further developments and consider blocking suspicious IPs using available threat intelligence solutions, as the risk of an imminent vulnerability disclosure or exploitation campaign remains elevated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
As the scanning spike was reported publicly, there was still no confirmed exploit tied to the activity and Palo Alto Networks had not issued a new advisory explaining the traffic flood. This left the cause of the surge unresolved despite the scale of the probing.
GreyNoise assessed with high confidence that the surge is connected to earlier campaigns targeting Palo Alto devices based on recurring TCP and JA4t fingerprints and reused infrastructure. The company also released a dedicated blocklist and advised defenders to tighten access controls, monitor login anomalies, and prepare blocking or IPS measures if the activity escalates.
Within 24 hours, malicious traffic against GlobalProtect portals increased nearly 40-fold and reached a 90-day high, totaling about 2.3 million scan sessions. Most traffic was attributed to AS200373 (3xK Tech GmbH), with additional probing from AS208885, and affected systems in the US, Mexico, and Pakistan at similar levels.
A large wave of malicious scanning targeting Palo Alto Networks GlobalProtect portals began on November 14, focusing on the PAN-OS/GlobalProtect endpoint global-protect/login.esp. GreyNoise observed the activity as broad opportunistic probing rather than a narrowly targeted campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
On October 3, 2025, threat intelligence firm GreyNoise detected a dramatic surge in scanning activity targeting Palo Alto Networks login portals, marking a nearly 500% increase in unique IP addresses involved compared to previous daily averages. This spike represented the highest level of such activity recorded in the past 90 days, with approximately 1,300 unique IP addresses participating in the scans, up from the typical 200. The vast majority of these IP addresses, about 93%, were classified as suspicious, while 7% were deemed malicious, indicating a significant threat level associated with the activity. Most of the scanning IPs were geolocated in the United States, but notable clusters also originated from the United Kingdom, the Netherlands, Canada, and Russia. The scanning was highly targeted, focusing on Palo Alto Networks login portals, including GlobalProtect and PAN-OS, and was primarily directed at emulated profiles set up by GreyNoise for monitoring purposes. Analysis revealed that the scanning activity was structured and likely derived from public internet scanning tools such as Shodan and Censys, or from attacker-originated reconnaissance efforts. Distinct clusters of scanning traffic were observed, with one group focusing on U.S.-based targets and another on Pakistan, each exhibiting unique but sometimes overlapping TLS fingerprints. The surge in Palo Alto scanning coincided with similar activity targeting Cisco ASA devices, with both sets of scans sharing regional clustering and fingerprinting overlaps, particularly a dominant TLS fingerprint linked to infrastructure in the Netherlands. GreyNoise noted that previous surges in scanning activity against Palo Alto technologies have sometimes preceded the disclosure of new vulnerabilities within six weeks, although not all such surges have led to new CVEs. The company referenced a similar incident in April 2025, which prompted Palo Alto Networks to urge customers to update their software. GreyNoise continues to monitor the situation closely, as such scanning activity can be an early indicator of forthcoming vulnerability disclosures or exploitation attempts. The targeted nature of the scans suggests that attackers may be seeking to identify vulnerable Palo Alto devices for potential compromise. The report underscores the importance for organizations using Palo Alto Networks products to ensure their systems are fully patched and to monitor for unusual login activity. The scanning activity's scale and coordination raise concerns about possible coordinated reconnaissance campaigns by threat actors. GreyNoise's research highlights the value of early warning signals in anticipating potential security incidents. The overlap in scanning techniques between Palo Alto and Cisco ASA devices may indicate shared attacker infrastructure or toolsets. Organizations are advised to block suspicious IPs identified in the scans and to review their exposure of management interfaces. The incident serves as a reminder of the persistent threat posed by automated and targeted internet scanning against critical network infrastructure.
Jun 29, 2026
A large-scale coordinated attack campaign targeted Palo Alto Networks GlobalProtect VPN portals and SonicWall SonicOS API endpoints in early December 2025. Over 7,000 IP addresses, primarily associated with the German hosting provider 3xK GmbH, were observed attempting to log into GlobalProtect portals and scanning SonicWall APIs. The activity was detected by threat intelligence firm GreyNoise, which noted that the same three client fingerprints used in this campaign had previously been seen in a separate wave of attacks between late September and mid-October, originating from different, typically non-malicious ASNs. The reuse of identical client fingerprints across different infrastructure and timeframes indicates a consistent set of tools and likely a single threat actor or group behind these campaigns. The attackers shifted their infrastructure but maintained the same attack patterns, focusing on credential-based attacks and brute-force attempts against remote access and API endpoints. This pattern highlights the ongoing risk to organizations using these technologies and the importance of monitoring for coordinated reconnaissance and credential abuse activity.
Jun 29, 2026
Threat actors launched a large-scale, automated credential-stuffing campaign targeting enterprise VPN authentication infrastructure, specifically focusing on Palo Alto Networks GlobalProtect and Cisco SSL VPN gateways. The campaign, observed in mid-December 2025, involved millions of scripted login attempts over a short period, with attackers pivoting rapidly between the two vendors. GreyNoise intelligence identified that the attacks originated almost exclusively from centralized infrastructure hosted by Germany’s 3xK GmbH, utilizing uniform request patterns, common username-password combinations, and atypical browser user agents to probe for weak or exposed VPN portals. Over 1.7 million login attempts were recorded against GlobalProtect portals in just 16 hours, with more than 10,000 unique IPs participating, primarily geolocated to the United States, Pakistan, and Mexico. Following the surge against Palo Alto, the attackers shifted focus to Cisco SSL VPNs, where a significant spike in unique attacking IPs was observed, rising from under 200 to 1,273 in a single day. The campaign did not exploit any zero-day vulnerabilities but relied on credential stuffing and password spraying techniques, indicating the use of potentially massive stolen credential lists. The uniformity in attack infrastructure, timing, and technical indicators across both VPN platforms underscores the persistent risk to remote access systems and highlights the need for robust authentication and monitoring of enterprise VPN endpoints.
Jun 29, 2026