Palo Alto Networks has revealed that it is observing brute-force login makes an attempt towards PAN-OS GlobalProtect gateways, days after menace hunters warned of a surge in suspicious login scanning exercise focusing on its home equipment.
“Our groups are observing proof of exercise in line with password-related assaults, resembling brute-force login makes an attempt, which doesn’t point out exploitation of a vulnerability,” a spokesperson for the corporate informed The Hacker Information. “We proceed to actively monitor this case and analyze the reported exercise to find out its potential affect and establish if mitigations are essential.”
The event comes after menace intelligence agency GreyNoise alerted of a spike in suspicious login scanning exercise geared toward PAN-OS GlobalProtect portals.
The corporate additional famous that the exercise commenced on March 17, 2025, hitting a peak of 23,958 distinctive IP addresses earlier than dropping off in the direction of the tip of final month. The sample signifies a coordinated effort to probe community defenses and establish uncovered or weak methods.
The login scanning exercise has primarily singled out methods in the US, the UK, Eire, Russia, and Singapore.
It is at the moment not identified how widespread these efforts are and if they’re the work of any particular menace actor at this stage. The Hacker Information has reached out to Palo Alto Networks for added feedback, and we’ll replace the story if we hear again.
Within the interim, all prospects are inspired to make sure that they’re operating the newest variations of PAN-OS. Different mitigations embody implementing multi-factor authentication (MFA), configuring GlobalProtect to facilitate MFA notifications, organising safety insurance policies to detect and block brute-force assaults, and limiting pointless publicity to the web.
