Cyber Frenzy: Brute-Force Onslaught Hits PAN-OS GlobalProtect Gateways

Summary

• Palo Alto Networks confirmed brute-force login attempts against PAN-OS GlobalProtect gateways in April 2025.
• The attempts followed a surge in login scanning that threat-intelligence firm GreyNoise traced to nearly 24,000 IP addresses.
• Palo Alto said the activity points to password attacks, with no sign that a software flaw is being exploited.
• The standard advice applies: multi-factor authentication (MFA) on the portal and current PAN-OS versions.

Login scanning against GlobalProtect jumps

GreyNoise first flagged the activity on March 31, 2025. Starting March 17, login scanners hit PAN-OS GlobalProtect portals from nearly 24,000 unique IP addresses, peaking at about 20,000 a day until March 26. Most of the traffic targeted systems in the United States.

Palo Alto Networks then told reporters its teams were seeing activity “consistent with password-related attacks, such as brute-force login attempts,” and that this “does not indicate exploitation of a vulnerability.” GlobalProtect is the VPN front door for many companies, so a guessed password on that portal can mean a foothold inside the network.

How a password-guessing campaign works

Brute-force tools cycle through usernames and passwords at machine speed until one works. They are cheap to run and can keep going for days without drawing attention if nobody is watching failed-login counts.

Palo Alto Networks says the campaign is aimed at accounts, not code. Weak, reused or default credentials are the target, so the fix sits with the customer’s own login policy.

What GlobalProtect admins can do now

Two controls do most of the work here: stronger authentication on the portal and up-to-date software.

Turn on MFA for every portal user

Multi-factor authentication (MFA) breaks the attack model. A guessed password alone no longer opens the tunnel, because the attacker also needs the second factor.

MFA should cover every account that can reach the portal, including service and contractor accounts that tend to get left out.

Keep PAN-OS current

Palo Alto Networks urged customers to run the latest PAN-OS release. This campaign is about passwords, but scanning waves like this one often come before attackers try newly disclosed bugs, so patch status matters.

Admins can also cap repeated authentication attempts and block the scanner IP addresses GreyNoise published.

Check your March logs

GreyNoise advised organizations with exposed Palo Alto systems to review logs from mid-March onward and hunt for signs of compromise on running systems.

Look for bursts of failed GlobalProtect logins from a single source, successful logins from unfamiliar locations, and accounts that logged in right after a run of failures.

The short version

The attackers here are guessing passwords. MFA, current PAN-OS builds and a look through recent authentication logs cover most of the risk.

If a GlobalProtect portal still accepts password-only logins, that is the first thing to change.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.