Hackers Gone Wild: 24,000 IPs Join the GlobalProtect Gateway Invasion Party!
Cybersecurity researchers have detected a spike in suspicious login scanning activity targeting Palo Alto Networks PAN-OS GlobalProtect gateways. Nearly 24,000 unique IP addresses are attempting to access these portals. This coordinated effort could be testing network defenses, paving the way for potential exploitation. Organizations should secure their systems immediately.
Hot Take:
Well, well, well, it seems like cybercriminals are throwing a party and Palo Alto Networks’ GlobalProtect gateways are the uninvited guests. With nearly 24,000 IP addresses trying to crash the network defenses, it’s starting to feel like a cybersecurity version of the ‘Who’s Who’ of the internet. If only firewalls could host a bouncer at the door to keep these pesky digital gatecrashers at bay!
Key Points:
- Palo Alto Networks’ GlobalProtect gateways are experiencing a spike in suspicious login scanning activity.
- Nearly 24,000 unique IP addresses have attempted to access these portals, with a peak of 23,958 IPs.
- Activity began on March 17, 2025, and sustained high levels until March 26.
- The United States and Canada are leading the charge in the number of IP addresses involved.
- Organizations are urged to secure their Palo Alto Networks instances to defend against potential exploitation.