Loading story…
A large-scale coordinated attack campaign targeted Palo Alto Networks GlobalProtect VPN portals and SonicWall SonicOS API endpoints in early December 2025. Over 7,000 IP addresses, primarily associated with the German hosting provider 3xK GmbH, were observed attempting to log into GlobalProtect portals and scanning SonicWall APIs. The activity was detected by threat intelligence firm GreyNoise, which noted that the same three client fingerprints used in this campaign had previously been seen in a separate wave of attacks between late September and mid-October, originating from different, typically non-malicious ASNs.
The reuse of identical client fingerprints across different infrastructure and timeframes indicates a consistent set of tools and likely a single threat actor or group behind these campaigns. The attackers shifted their infrastructure but maintained the same attack patterns, focusing on credential-based attacks and brute-force attempts against remote access and API endpoints. This pattern highlights the ongoing risk to organizations using these technologies and the importance of monitoring for coordinated reconnaissance and credential abuse activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Following the observed attacks, Palo Alto Networks confirmed the activity involved credential-based login attempts rather than exploitation of a software vulnerability. The company said it had seen no compromise of its products or services.
On publication of its research, GreyNoise disclosed the hidden pattern linking the September-October and December activity through recurring client fingerprints. The company also recommended monitoring abnormal authentication activity, tracking fingerprints, and using dynamic blocking and blocklists to defend against the campaign.
On December 3, 2025, a similar surge targeted SonicWall SonicOS API endpoints. GreyNoise linked this activity to the GlobalProtect campaign because it used the same client fingerprints, suggesting the same actor or tooling across different vendors and infrastructure.
On December 2, 2025, GreyNoise detected a significant spike in login attempts against Palo Alto Networks GlobalProtect portals from more than 7,000 IPs tied to 3xK GmbH infrastructure. The activity reused the same three client fingerprints seen in the earlier campaign, indicating continuity in attacker tooling.
After the September-October surge, GreyNoise reported reduced credential-based attack activity against GlobalProtect targets in late November 2025. This lull preceded a renewed spike in early December.
GreyNoise observed a previous large-scale campaign targeting Palo Alto Networks GlobalProtect portals from late September to mid-October 2025. The activity generated more than 9 million HTTP sessions and used three client fingerprints later seen again in December.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors launched a large-scale, automated credential-stuffing campaign targeting enterprise VPN authentication infrastructure, specifically focusing on Palo Alto Networks GlobalProtect and Cisco SSL VPN gateways. The campaign, observed in mid-December 2025, involved millions of scripted login attempts over a short period, with attackers pivoting rapidly between the two vendors. GreyNoise intelligence identified that the attacks originated almost exclusively from centralized infrastructure hosted by Germany’s 3xK GmbH, utilizing uniform request patterns, common username-password combinations, and atypical browser user agents to probe for weak or exposed VPN portals. Over 1.7 million login attempts were recorded against GlobalProtect portals in just 16 hours, with more than 10,000 unique IPs participating, primarily geolocated to the United States, Pakistan, and Mexico. Following the surge against Palo Alto, the attackers shifted focus to Cisco SSL VPNs, where a significant spike in unique attacking IPs was observed, rising from under 200 to 1,273 in a single day. The campaign did not exploit any zero-day vulnerabilities but relied on credential stuffing and password spraying techniques, indicating the use of potentially massive stolen credential lists. The uniformity in attack infrastructure, timing, and technical indicators across both VPN platforms underscores the persistent risk to remote access systems and highlights the need for robust authentication and monitoring of enterprise VPN endpoints.
Jun 29, 2026
A sudden and dramatic increase in malicious traffic targeting Palo Alto Networks' GlobalProtect portals was observed, with activity surging 40-fold within a 24-hour period starting November 14, 2025. Security researchers at GreyNoise recorded approximately 2.3 million sessions directed at the `global-protect/login.esp` endpoint, marking a 90-day high in scanning activity. The majority of this traffic originated from the AS200373 (3xK Tech GmbH) network, primarily geolocated in Germany and Canada, with a secondary contribution from AS208885. The scanning was broad, affecting systems in the US, Mexico, and Pakistan, and is believed to be opportunistic rather than targeted. GreyNoise analysts have identified recurring technical fingerprints and infrastructure linking this surge to previous campaigns, suggesting the involvement of the same threat actor(s). Historical patterns indicate that such spikes in scanning activity often precede the disclosure or exploitation of new vulnerabilities in the targeted vendor's products. Defenders are advised to monitor for further developments and consider blocking suspicious IPs using available threat intelligence solutions, as the risk of an imminent vulnerability disclosure or exploitation campaign remains elevated.
Jun 29, 2026
On October 3, 2025, threat intelligence firm GreyNoise detected a dramatic surge in scanning activity targeting Palo Alto Networks login portals, marking a nearly 500% increase in unique IP addresses involved compared to previous daily averages. This spike represented the highest level of such activity recorded in the past 90 days, with approximately 1,300 unique IP addresses participating in the scans, up from the typical 200. The vast majority of these IP addresses, about 93%, were classified as suspicious, while 7% were deemed malicious, indicating a significant threat level associated with the activity. Most of the scanning IPs were geolocated in the United States, but notable clusters also originated from the United Kingdom, the Netherlands, Canada, and Russia. The scanning was highly targeted, focusing on Palo Alto Networks login portals, including GlobalProtect and PAN-OS, and was primarily directed at emulated profiles set up by GreyNoise for monitoring purposes. Analysis revealed that the scanning activity was structured and likely derived from public internet scanning tools such as Shodan and Censys, or from attacker-originated reconnaissance efforts. Distinct clusters of scanning traffic were observed, with one group focusing on U.S.-based targets and another on Pakistan, each exhibiting unique but sometimes overlapping TLS fingerprints. The surge in Palo Alto scanning coincided with similar activity targeting Cisco ASA devices, with both sets of scans sharing regional clustering and fingerprinting overlaps, particularly a dominant TLS fingerprint linked to infrastructure in the Netherlands. GreyNoise noted that previous surges in scanning activity against Palo Alto technologies have sometimes preceded the disclosure of new vulnerabilities within six weeks, although not all such surges have led to new CVEs. The company referenced a similar incident in April 2025, which prompted Palo Alto Networks to urge customers to update their software. GreyNoise continues to monitor the situation closely, as such scanning activity can be an early indicator of forthcoming vulnerability disclosures or exploitation attempts. The targeted nature of the scans suggests that attackers may be seeking to identify vulnerable Palo Alto devices for potential compromise. The report underscores the importance for organizations using Palo Alto Networks products to ensure their systems are fully patched and to monitor for unusual login activity. The scanning activity's scale and coordination raise concerns about possible coordinated reconnaissance campaigns by threat actors. GreyNoise's research highlights the value of early warning signals in anticipating potential security incidents. The overlap in scanning techniques between Palo Alto and Cisco ASA devices may indicate shared attacker infrastructure or toolsets. Organizations are advised to block suspicious IPs identified in the scans and to review their exposure of management interfaces. The incident serves as a reminder of the persistent threat posed by automated and targeted internet scanning against critical network infrastructure.
Jun 29, 2026