Hackers Scanning From 24,000 IPs to Gain Access to Palo Alto Networks GlobalProtect Portals

Researchers observed a surge of malicious scanning activity against Palo Alto Networks GlobalProtect VPN portals between March 17–26, 2025, involving ~24,000 unique source IPs (predominantly US and Canada). GreyNoise classified most sources as suspicious and identified three JA4h fingerprints tied to the login scanner tool, with a large share of traffic linked to ASN200373 (3xK Tech GmbH); the report references CVE-2024-3400 (PAN-OS command injection, CVSS 10.0) and advises immediate log review, threat hunting, patching, and blocking of identified IPs.