InfoSecBulletin Cybersecurity for mankind
GreyNoise reported that login attempts on GlobalProtect portals surged to 1.7 million over 16 hours, targeting various VPNs, including Palo Alto Networks GlobalProtect and Cisco SSL VPN.
Data revealed that over 10,000 unique IP addresses targeted infrastructure in the United States, Mexico, and Pakistan. The malicious traffic originated almost entirely from the 3xK GmbH (Germany) IP space, indicating a centralized cloud infrastructure.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Researchers observed that the threat actor reused common username and password combinations, with most requests coming from a rarer Firefox user agent for automated logins with this provider.
Source: GreyNoise
“The consistency of the user agent, request structure, and timing suggests scripted credential probing designed to identify exposed or weakly protected GlobalProtect portals, rather than interactive access attempts or vulnerability exploitation,” GreyNoise explains.
“This activity reflects continued pressure against enterprise VPN authentication endpoints, a pattern GreyNoise has observed repeatedly during periods of heightened attacker activity.”
On December 12, probing activity from the same hosting provider targeting Cisco SSL VPNs began, with unique attack IPs rising to 1,273 compared to the usual fewer than 200. This marks the first major use of 3xK-hosted IPs against Cisco SSL VPNs in 12 weeks.
Palo Alto Networks confirmed to the media that they are aware of the situation. They advise users to use strong passwords and multi-factor authentication.
“We are aware of the credential-based activity reported by GreyNoise targeting VPN gateways, including GlobalProtect portals. This activity reflects automated credential probing and does not constitute a compromise of our environment or an exploitation of any Palo Alto Networks vulnerability,” the Palo Alto Networks spokesperson said.
“Our investigation confirms that these are scripted attempts to identify weak credentials,” they added. Grey Noise suggests checking network devices for unusual logins and blocking malicious IPs.
