Loading story…
Threat actors launched a large-scale, automated credential-stuffing campaign targeting enterprise VPN authentication infrastructure, specifically focusing on Palo Alto Networks GlobalProtect and Cisco SSL VPN gateways. The campaign, observed in mid-December 2025, involved millions of scripted login attempts over a short period, with attackers pivoting rapidly between the two vendors. GreyNoise intelligence identified that the attacks originated almost exclusively from centralized infrastructure hosted by Germany’s 3xK GmbH, utilizing uniform request patterns, common username-password combinations, and atypical browser user agents to probe for weak or exposed VPN portals. Over 1.7 million login attempts were recorded against GlobalProtect portals in just 16 hours, with more than 10,000 unique IPs participating, primarily geolocated to the United States, Pakistan, and Mexico.
Following the surge against Palo Alto, the attackers shifted focus to Cisco SSL VPNs, where a significant spike in unique attacking IPs was observed, rising from under 200 to 1,273 in a single day. The campaign did not exploit any zero-day vulnerabilities but relied on credential stuffing and password spraying techniques, indicating the use of potentially massive stolen credential lists. The uniformity in attack infrastructure, timing, and technical indicators across both VPN platforms underscores the persistent risk to remote access systems and highlights the need for robust authentication and monitoring of enterprise VPN endpoints.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following public reporting on the campaign, Palo Alto Networks stated it was aware of the activity and emphasized that no vulnerabilities in its products were exploited. Reporting also noted GreyNoise found no evidence connecting the campaign to the recently disclosed Cisco AsyncOS zero-day CVE-2025-20393 or Cisco Talos' UAT-9686 activity.
GreyNoise published research describing the two-day campaign against Cisco and Palo Alto VPN gateways, attributing it to automated scripted login attempts using common credentials and consistent user agents. The company advised defenders to enforce MFA, strengthen passwords, audit edge devices, and block the identified malicious IPs.
Over the following day in mid-December 2025, the same coordinated infrastructure and tooling shifted to targeting Cisco SSL VPN authentication portals. GreyNoise said this marked the first large-scale use of 3xK-hosted IPs against Cisco SSL VPN portals in the prior 12 weeks and found the activity was credential-based rather than vulnerability exploitation.
In mid-December 2025, GreyNoise observed a large-scale automated password-spraying and credential-stuffing campaign targeting Palo Alto Networks GlobalProtect VPN portals. The activity generated roughly 1.7 million login attempts within 16 hours from more than 10,000 IPs, largely tied to infrastructure hosted by Germany-based 3xK GmbH.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale coordinated attack campaign targeted Palo Alto Networks GlobalProtect VPN portals and SonicWall SonicOS API endpoints in early December 2025. Over 7,000 IP addresses, primarily associated with the German hosting provider 3xK GmbH, were observed attempting to log into GlobalProtect portals and scanning SonicWall APIs. The activity was detected by threat intelligence firm GreyNoise, which noted that the same three client fingerprints used in this campaign had previously been seen in a separate wave of attacks between late September and mid-October, originating from different, typically non-malicious ASNs. The reuse of identical client fingerprints across different infrastructure and timeframes indicates a consistent set of tools and likely a single threat actor or group behind these campaigns. The attackers shifted their infrastructure but maintained the same attack patterns, focusing on credential-based attacks and brute-force attempts against remote access and API endpoints. This pattern highlights the ongoing risk to organizations using these technologies and the importance of monitoring for coordinated reconnaissance and credential abuse activity.
Jun 29, 2026
A coordinated cyberattack campaign has been identified targeting major networking devices from Cisco, Palo Alto Networks, and Fortinet, with evidence suggesting a single threat actor is orchestrating the activity. Security researchers at GreyNoise observed simultaneous scanning of Cisco ASA devices, increased login attempts against Palo Alto Networks portals, and brute-force attacks on Fortinet SSL VPNs, all originating from shared subnets and exhibiting recurring TCP fingerprints. This temporal and infrastructural correlation points to a sophisticated, cross-vendor campaign rather than opportunistic attacks. Experts note that adversaries are leveraging generative AI to automate these attacks, adopting tactics typically associated with nation-state actors. The campaign is notable for its focus on high-value targets such as networking devices and VPNs, which serve as critical gateways into enterprise networks and often possess privileged access that can bypass internal security controls. Industries such as manufacturing, industrials, and utilities are particularly at risk due to the potential for operational disruption and rapid financial gain for attackers. Concurrently, Cisco disclosed two zero-day vulnerabilities in its ASA and Secure Firewall Threat Defense software, identified as CVE-2025-20333 and CVE-2025-20362, which are being actively exploited in the wild. CVE-2025-20333 allows authenticated remote code execution due to improper input validation in the VPN web server, potentially granting attackers root-level access. CVE-2025-20362 is an authentication bypass flaw that enables remote attackers to access restricted endpoints without credentials. The combination of these vulnerabilities poses a severe risk, as attackers can gain full control of affected devices. Cisco’s Product Security Incident Response Team (PSIRT) has confirmed ongoing exploitation and is collaborating with government agencies to coordinate a response. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging all federal agencies to immediately mitigate exposure and assess for compromise. Over 90,000 Cisco FTD devices are reportedly exposed, highlighting the scale of the threat. Attackers are conducting large-scale scanning campaigns to identify vulnerable ASA login portals and entry points. Security experts emphasize the urgent need for organizations to inventory their Cisco ASA and FTD devices, apply available patches, and implement recommended mitigations. The campaign’s use of shared infrastructure and advanced automation underscores a shift in attacker methodology toward more efficient and targeted operations. The strategic targeting of network infrastructure devices reflects their critical role in enterprise security and the high impact of successful compromise. Organizations are advised to monitor for signs of compromise, follow vendor and government guidance, and prioritize remediation of affected systems. The ongoing nature of the attacks and the active exploitation of zero-day vulnerabilities make this a critical threat to enterprise and government networks worldwide.
Jun 29, 2026
Huntress reported an active credential-stuffing and brute-force campaign targeting **SonicWall** VPN and firewall login portals, compromising 30 organizations and 92 user accounts in roughly 41 hours. The activity began on July 25 and used authorized logins against remote access interfaces rather than exploiting a software vulnerability, with attacks described as broad and opportunistic instead of focused on a particular sector. Huntress said the observed victims were all its customers using SonicWall devices, indicating the total number of affected organizations could be higher. Investigators traced the automated credential-validation activity to a small set of malicious IP addresses registered to **DigitalOcean** and said the pattern aligns with recurring SonicWall SSLVPN targeting seen in 2025 and 2026, including abuse of reused compromised credentials. Huntress said it had not yet observed post-compromise hands-on-keyboard activity, raising concern that the intrusions may be intended to pre-position access for later operations. At the time of reporting, SonicWall said it was investigating and had not issued a security advisory, while Huntress urged defenders to restrict remote management, reset credentials and secrets, review authentication logs, and enforce **MFA**.
Aug 2, 2026