New password spraying attacks target Cisco, PAN VPN gateways

An automated credential-stuffing campaign has been observed targeting GlobalProtect and Cisco SSL VPN portals, peaking at 1.7 million login attempts over ~16 hours and originating from thousands of IPs hosted by 3xK GmbH; activity exhibits consistent user-agent and request structure indicating scripted probes rather than exploitation, and GreyNoise found no evidence tying this activity to the recently disclosed Cisco AsyncOS zero-day. Vendors advise using strong passwords and MFA, and administrators are urged to audit appliances, monitor for unexpected logins, and block known malicious IPs.