Credential Chaos: Automated Attacks Target VPN Giants Palo Alto and Cisco
Credential-based attacks are targeting Palo Alto Networks GlobalProtect, with a peak of 1.7 million attempts in 16 hours. Over 10,000 unique IP addresses were involved, mostly from Germany. The attackers are using common username and password combos. Palo Alto Networks assures that these are scripted attempts, not a compromise of its environment.
Hot Take:
When it rains, it pours, and when it hacks, it cracks! Apparently, cybercriminals are taking their holiday shopping to VPN platforms, trying to bag some credentials instead of Black Friday deals. Who knew VPNs were the new hot commodity on the hacker holiday wish list?
Key Points:
- Massive credential-based attacks targeted VPN platforms, specifically Palo Alto Networks GlobalProtect and Cisco SSL VPN.
- GreyNoise observed peaks of 1.7 million login attempts within 16 hours, originating from over 10,000 IPs.
- Attacks came mainly from the 3xK GmbH IP space, with a consistent Firefox user agent hinting at automated probes.
- Cisco warned of a separate zero-day vulnerability, but no link to these attacks was found.
- Recommendations include using strong passwords, multi-factor authentication, and monitoring for suspicious activity.
Already a member? Log in here