Global Cyber Siege: 24,000 IPs Assault PAN-OS Security System

Summary

• Security firm GreyNoise spotted a surge of nearly 24,000 unique IP addresses probing Palo Alto Networks PAN-OS GlobalProtect login portals.
• The activity was login scanning, not a confirmed exploit of a specific flaw.
• Coordinated scanning like this often comes before attacks on newly disclosed vulnerabilities.
• Defenders should check exposure of GlobalProtect portals and keep PAN-OS patched.

The Scanning Surge

In late March 2025, threat intelligence firm GreyNoise reported a sharp rise in login scanning against Palo Alto Networks PAN-OS GlobalProtect portals. Nearly 24,000 unique IP addresses tried to access these portals from mid-March onward. Activity peaked at close to 20,000 addresses a day.

GreyNoise classified most of the addresses as suspicious and a smaller number as clearly malicious. It did not tie the activity to a specific vulnerability. Its research shows that scanning spikes like this one are often followed within weeks by the disclosure of a new flaw in the same product. That makes the surge a warning sign worth taking seriously.

Understanding the Activity

The scale points to planning. Much of the traffic came from a small number of hosting networks. Large scanning campaigns like this are usually about mapping targets. Attackers find which login pages are exposed so they can move quickly when an exploit becomes available.

Firewalls and VPN gateways are attractive targets because they sit on the network edge. One weakness there can give an attacker a path into the whole network. Stolen or guessed credentials are a risk too, so login portals need strong authentication.

What Defenders Should Do

Organizations that run PAN-OS GlobalProtect should review their logs for unusual login attempts. They should limit portal exposure where possible and apply the latest updates. GreyNoise also suggested blocking known malicious scanning addresses.

Multi-factor authentication on the VPN portal is a must. It blunts credential guessing. It also limits the damage if a password leaks.

Edge devices from many vendors have been hit by serious attacks in recent years. Security teams should treat VPN and firewall portals as some of their most exposed assets.

Time to Act

This was scanning, not a confirmed breach. Still, history shows that attackers often probe before they strike. Organizations running GlobalProtect should check exposure and patch quickly.

Watch your edge devices closely. A spike in probes is cheap early warning, and it’s worth acting on before an exploit appears.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.