New wave of VPN login attempts targets Palo Alto GlobalProtect portals
ID: 33b7f587-9ee4-56de-8451-75acc133c37d
STIX ID: report--33b7f587-9ee4-56de-8451-75acc133c37d
Feed Name: Bleeping Computer
Threat Score
GreyNoise observed a large-scale campaign beginning December 2 that used over 7,000 IPs from 3xK GmbH to perform credential-stuffing/brute-force attempts against Palo Alto GlobalProtect portals and scan SonicWall SonicOS API endpoints, producing millions of sessions; vendors report credential-based attacks and scanning activity but no confirmed product compromise, and defenders are advised to monitor authentication failures, client fingerprints, and block malicious IPs while enforcing MFA.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.