VPN Under Siege: Palo Alto Networks GlobalProtect Faces Massive 40x Surge in Malicious Scans
Malicious scanning activity on Palo Alto Networks GlobalProtect VPN portals skyrocketed, increasing 40 times in just 24 hours. GreyNoise has linked this escalation to previously identified campaigns, with a 90-day high reached in November. Primarily targeting the US, Mexico, and Pakistan, these attacks highlight the need for vigilance and proactive security measures.
Hot Take:
It seems like cybercriminals have a new favorite hobby: hacking Palo Alto Networks VPN login portals. It’s like they’ve found a treasure map and can’t resist digging for the gold hidden within. Just when you thought it was safe to log in, they hit you with a 40x surge in malicious activity. Maybe it’s time to consider a secret handshake instead of a password?
Key Points:
– Malicious scanning targeting Palo Alto Networks GlobalProtect VPN login portals increased 40 times in just 24 hours.
– GreyNoise reports the highest level of activity in 90 days, starting from November 14, 2025.
– The majority of the IPs involved come from Germany and Canada.
– 2.3 million sessions were observed targeting the login endpoint between November 14 and 19.
– Historical data shows scanning spikes often precede new security flaw disclosures.