Massive surge in scans targeting Palo Alto Networks login portals

GreyNoise observed a sharp surge in scans focused on Palo Alto GlobalProtect and PAN-OS login portals—about a 500% increase with a peak of ~1,285 unique IPs (91% suspicious, 7% malicious)—alongside coordinated exploitation attempts against Grafana CVE-2021-43798 from roughly 110 malicious IPs; administrators are advised to patch Grafana, block the identified IPs, and review logs for path-traversal activity.