Loading story…
China’s Cybersecurity Review Office has opened a cybersecurity review of Palo Alto Networks products sold in the country, citing the need to protect critical information infrastructure, prevent cybersecurity risks and vulnerabilities, and safeguard national security. The notice says the action is being taken under China’s National Security Law, Cybersecurity Law, and the Measures for Cybersecurity Review, but it does not identify any specific product, allegation, or technical issue.
Palo Alto Networks said the review has not affected its ability to support customers or deliver products and services in China. The move echoes Beijing’s earlier scrutiny of foreign technology suppliers, including a prior review of Micron that ended with a finding that its products posed unacceptable risks for operators of critical infrastructure and effectively restricted those sales in the Chinese market.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In response to China's cybersecurity review, Palo Alto Networks said it maintains high standards across its global operations and that there was no current impact on its ability to serve customers or deliver products in China.
China's Cybersecurity Review Office announced that it is conducting a cybersecurity review of Palo Alto Networks products sold in China. The notice said the review is intended to protect the secure and stable operation of critical information infrastructure, prevent cybersecurity risks, and safeguard national security.
In January 2026, Chinese authorities directed domestic companies to stop using cybersecurity software from about a dozen U.S. and Israeli vendors. Palo Alto Networks was among the companies covered by the order.
The reporting notes that China had earlier launched a security investigation into Micron's products in 2023. This prior case is presented as a comparison for the Palo Alto Networks review.
After its review, China's CAC concluded that Micron products posed an unacceptable security risk for critical infrastructure operators. The decision effectively barred sales of Micron products to those entities in China.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcetheregister.com
Open sourcecyberveille.ch
Open sourcecac.gov.cn
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China has reportedly instructed domestic organizations to stop using cybersecurity software from multiple **U.S. and Israeli vendors**, citing national security concerns that such tools could collect sensitive data and transmit it abroad. The directive, reported by Reuters and echoed in follow-on coverage, appears consistent with Beijing’s broader technology decoupling efforts and long-running policy initiatives to replace foreign technology in critical environments with domestic alternatives. Named vendors affected include **VMware (Broadcom)**, **Palo Alto Networks**, **Fortinet**, and Israel-based **Check Point**, with additional reporting listing a wider set of impacted security suppliers such as **Mandiant**, **CrowdStrike**, **SentinelOne**, **McAfee**, **Recorded Future**, **Claroty**, **Rapid7**, and **Wiz**, as well as Israeli firms **CyberArk**, **Orca Security**, **Cato Networks**, and **Imperva** (Thales-owned). Reporting indicates uncertainty about which Chinese entities received the notice and how broadly it applies, but notes the move had immediate market impact on affected companies’ stocks and aligns with China’s stated goal of reducing reliance on foreign software across state-linked sectors.
Jun 29, 2026
China’s Military Procurement Network suspended or banned several prominent domestic cybersecurity companies from PLA-related contracts in the first half of 2026 over alleged procurement violations, with collusive bidding cited as a central concern. Companies named in reporting include **TopSec**, **Venustech**, and subsidiaries of **Qi An Xin**, all of which are described as significant players in China’s cybersecurity sector and part of the broader ecosystem that has supported government and military cyber activity. The action has drawn added scrutiny because it follows earlier reporting on leaked **i-SOON** documents that allegedly detailed bid-rigging and coordinated bidding practices among Chinese cybersecurity vendors competing for state contracts. The measures suggest tighter military procurement oversight in China and could disrupt firms with close links to state security work, while exposing governance and compliance risks inside a sector long intertwined with official cyber operations.
Jul 16, 2026
On October 3, 2025, threat intelligence firm GreyNoise detected a dramatic surge in scanning activity targeting Palo Alto Networks login portals, marking a nearly 500% increase in unique IP addresses involved compared to previous daily averages. This spike represented the highest level of such activity recorded in the past 90 days, with approximately 1,300 unique IP addresses participating in the scans, up from the typical 200. The vast majority of these IP addresses, about 93%, were classified as suspicious, while 7% were deemed malicious, indicating a significant threat level associated with the activity. Most of the scanning IPs were geolocated in the United States, but notable clusters also originated from the United Kingdom, the Netherlands, Canada, and Russia. The scanning was highly targeted, focusing on Palo Alto Networks login portals, including GlobalProtect and PAN-OS, and was primarily directed at emulated profiles set up by GreyNoise for monitoring purposes. Analysis revealed that the scanning activity was structured and likely derived from public internet scanning tools such as Shodan and Censys, or from attacker-originated reconnaissance efforts. Distinct clusters of scanning traffic were observed, with one group focusing on U.S.-based targets and another on Pakistan, each exhibiting unique but sometimes overlapping TLS fingerprints. The surge in Palo Alto scanning coincided with similar activity targeting Cisco ASA devices, with both sets of scans sharing regional clustering and fingerprinting overlaps, particularly a dominant TLS fingerprint linked to infrastructure in the Netherlands. GreyNoise noted that previous surges in scanning activity against Palo Alto technologies have sometimes preceded the disclosure of new vulnerabilities within six weeks, although not all such surges have led to new CVEs. The company referenced a similar incident in April 2025, which prompted Palo Alto Networks to urge customers to update their software. GreyNoise continues to monitor the situation closely, as such scanning activity can be an early indicator of forthcoming vulnerability disclosures or exploitation attempts. The targeted nature of the scans suggests that attackers may be seeking to identify vulnerable Palo Alto devices for potential compromise. The report underscores the importance for organizations using Palo Alto Networks products to ensure their systems are fully patched and to monitor for unusual login activity. The scanning activity's scale and coordination raise concerns about possible coordinated reconnaissance campaigns by threat actors. GreyNoise's research highlights the value of early warning signals in anticipating potential security incidents. The overlap in scanning techniques between Palo Alto and Cisco ASA devices may indicate shared attacker infrastructure or toolsets. Organizations are advised to block suspicious IPs identified in the scans and to review their exposure of management interfaces. The incident serves as a reminder of the persistent threat posed by automated and targeted internet scanning against critical network infrastructure.
Jun 29, 2026