Hackers Deploy 24,000 IPs to Breach Palo Alto Networks GlobalProtect

GreyNoise observed a coordinated surge of reconnaissance activity targeting Palo Alto Networks PAN-OS GlobalProtect login portals from March 17–26, 2025, involving roughly 24,000 unique IPs (predominantly from the United States and Canada), with significant contribution from ASN200373 (3xK Tech GmbH) and three identified scanner tool JA4h hashes; organizations are advised to audit logs, perform threat hunts, and block malicious IPs to mitigate potential follow-on exploitation.