Surge in Scans on PAN GlobalProtect VPNs Hints at Attacks

Security researchers observed a sharp surge of scanning activity (≈24,000 unique IPs) targeting Palo Alto Networks' GlobalProtect VPN management portal from March 17–26, likely as reconnaissance in preparation for vulnerabilities or exploitation; GreyNoise and industry commentators warn this pattern often precedes zero-day disclosures or active campaigns and recommend log reviews and forensic/threat-hunting on potentially affected systems.