Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways
Summary: GreyNoise tracked a coordinated, automated credential-based campaign against Cisco SSL VPN and Palo Alto Networks GlobalProtect services over a two-day period in mid-December, with roughly 1.7 million sessions hitting emulated GlobalProtect portals in 16 hours and more than 10,000 unique IPs attempting logins on 11 December. On 12 December, daily unique attacking IPs against Cisco SSL VPN endpoints rose from a baseline of fewer than 200 to 1,273, sharing the same TCP fingerprint and 3xK GmbH hosting infrastructure as the GlobalProtect activity.
What you should know: More than 10,000 unique IPs in a single day, all routed through one German hosting provider, means the barrier to running this kind of credential probing at scale is low and the source is centralized enough to block - if your VPN gateways are watching for it.
Read the original at GreyNoise Blog ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026