Palo Alto Networks gateways facing huge number of possible security attacks

GreyNoise observed a spike in scanning throughout March 2025
Thousands of IP addresses were scanning PAN-OS GlobalProtect portals
These activities usually lead up to a cyberattack, researchers claim

Someone may be getting ready to attack Palo Alto Network devices, security researchers are warning after spotting a rise in activity.

Analysts from GreyNoise said they observed a “significant surge” in login scanning activity against the company’s PAN-OS GlobalProtect portals, with almost 24,000 unique IP addresses attempting to access these portals in March 2025.

“The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation,” the article reads. This could also mean that someone’s found a zero-day vulnerability in these endpoints and is now looking to see how many endpoints it can compromise through it.

Remote code execution risks

“Over the past 18 to 24 months, we’ve observed a consistent pattern of deliberate targeting of older vulnerabilities or well-worn attack and reconnaissance attempts against specific technologies,” said Bob Rudis, VP of Data Science at GreyNoise. “These patterns often coincide with new vulnerabilities emerging 2 to 4 weeks later.”

For GreyNoise, there is no doubt that this is a malicious campaign. Of the 24,000 unique IP addresses that scanned Palo Alto devices, 154 were labeled as “malicious” beyond reasonable doubt, while the rest were classified as “suspicious” in the past. Their locations are mostly in North America, throughout the US and Canada.

The majority of the targets are also based in the US.

GreyNoise says this activity could be linked to separate PAN-OS reconnaissance-related tags, such as PAN-OS Crawler, where they observed a single spike on March 26, 2025 involving 2,580 unique source IPs.

Obviously, the end goal is not known at this time, but vigilance is advised. IT teams should review their logs since mid-March to see if they were targeted, and should be on the lookout for signs of compromise. They should also harden their login portals and block known malicious IPs.

Via BleepingComputer

https://cdn.mos.cms.futurecdn.net/WM6ovpb9L3msvjTnWARTZA-1200-80.jpg

Source link

Intel is developing a cooling solution capable of handling 1.5kW of heat, one that could be used on Nvidia’s GB300 superchip

OpenAI is giving away ChatGPT Plus subscriptions to students to help you study for finals – here’s how to apply

Windows is about to get its biggest intelligent upgrade thanks to Copilot

Tour of Flanders live stream 2025: How to watch WorldTour cycling online from anywhere

Ex-Israeli Intelligence Official: Shockwaves of Trump’s “Take Over Gaza” Heard, Felt Across Region

What UK political parties are promising in the 2019 general election

Otto Warmbier’s parents want North Korea to suffer for their son’s death

Could a ‘youthquake’ cause Boris Johnson to lose the general election?

Which Celebrity Styles Americans Copy Most in 2025: New Study

New ‘Westworld’ trailer introduces us to another dystopian tech company

What’s the point of ‘Charlie’s Angels’ without Sam Rockwell dancing?

These striking photos capture the future of human flight

Self-made millionaire Barbara Corcoran warns not to make the mistake of asking for a raise: Do these 2 things instead

Brookfield Property stock hits 52-week low at $11.81

Trump’s tariffs are not ‘common sense’—and they’re putting America’s credibility and ‘exorbitant privilege’ at risk

PNNT stock touches 52-week low at $6.42 amid market shifts

The YouTuber who has become one of Gen Z’s most beloved celebrities

26 last-minute holiday gifts that are still thoughtful and unique

Practicing gratitude regularly can make you less stressed and sleep better

8 things millennials wish you would just stop getting them for the holidays

Palo Alto Networks gateways facing huge number of possible security attacks

Self-made millionaire Barbara Corcoran warns not to make the mistake of asking for a raise: Do these 2 things instead

Brookfield Property stock hits 52-week low at $11.81

Intel is developing a cooling solution capable of handling 1.5kW of heat, one that could be used on Nvidia’s GB300 superchip

Trump’s tariffs are not ‘common sense’—and they’re putting America’s credibility and ‘exorbitant privilege’ at risk

Leave a reply Cancel reply