Palo Alto Scanning Surges ~500% in 48 Hours, Marking 90-Day High
Summary: GreyNoise observed a roughly 500% increase in unique IPs scanning Palo Alto Networks PAN-OS GlobalProtect login portals on 3 October 2025, the highest level in 90 days, rising from about 1,300 IPs that afternoon to over 2,200 by 7 October. GreyNoise links the activity to concurrent Cisco ASA scanning and Fortinet SSL VPN brute forcing through shared subnets and a dominant TCP fingerprint tied to infrastructure in the Netherlands, and assesses with high confidence that all three campaigns are at least partially driven by the same threat actor(s).
Key Takeaway: GreyNoise's July research found that surges in activity against Palo Alto and Fortinet technologies have in some cases been followed by new vulnerability disclosures within six weeks, and its earlier ASA scanning surge preceded Cisco's disclosure of two ASA zero-days.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026