A Hidden Pattern Within Months of Credential-Based Attacks Against Palo Alto Global Protect

Summary: On 2 December 2025, GreyNoise observed a concentrated spike of more than 7,000 IPs attempting to log into Palo Alto Networks GlobalProtect portals, all originating from infrastructure operated by 3xK GmbH and targeting two Palo Alto profiles in its Global Observation Grid. The December traffic shares three identical client fingerprints with a larger wave seen between late September and mid-October, when four ASNs generated over 9 million non-spoofable HTTP sessions, and the same three fingerprints appeared again on 3 December in scanning against SonicWall SonicOS API endpoints.
Key Takeaway: The infrastructure and the vendors changed, but the client fingerprints stayed identical, which points to tooling continuity across events that would otherwise look unrelated. A security leader whose GlobalProtect or SonicWall authentication surfaces sit exposed should weigh that against the 9 million sessions already generated in the earlier wave.

Read the original at GreyNoise Blog ↗