Palo Alto Scanning Surges 40X in 24 Hours, Marking 90-Day High
Summary: GreyNoise observed a 40x surge in scanning activity targeting Palo Alto Networks GlobalProtect portals within 24 hours beginning 14 November 2025, reaching a new 90-day high. Since that date, GreyNoise has recorded 2.3 million sessions hitting the /global-protect/login.esp URI, with traffic anchored in AS200373 (3xK Tech GmbH) across German and Canadian geolocation clusters and a secondary contribution from AS208885 (Noyobzoda Faridduni Saidilhom).
Why it matters: GreyNoise assesses with high confidence that the same threat actor or actors are at least partially behind this campaign and prior related ones first identified in July, so 2.3 million sessions against a single login endpoint represent sustained, coordinated attention rather than background noise.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026