Surge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming Threats
Summary: GreyNoise observed nearly 24,000 unique IP addresses attempting login scans against Palo Alto Networks PAN-OS GlobalProtect portals over 30 days, with 20,010 of them tied to 3xK Tech GmbH under ASN200373. GreyNoise's Bob Rudis said the pattern of targeting older vulnerabilities and well-worn reconnaissance against specific technologies often coincides with new vulnerabilities emerging 2 to 4 weeks later.
Bottom line: GreyNoise tied this scanning pattern to new vulnerabilities appearing 2 to 4 weeks afterward, so the roughly 24,000 source IPs probing GlobalProtect portals now may be the run-up to exploitation your edge devices will face next.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026