Palo Alto Networks gateways facing huge number of possible security attacks

Activities like these usually lead up to the discovery of a new zero-day, experts warn.

Apr 2, 2025 - 15:02

Palo Alto Networks gateways facing huge number of possible security attacks

GreyNoise observed a spike in scanning throughout March 2025
Thousands of IP addresses were scanning PAN-OS GlobalProtect portals
These activities usually lead up to a cyberattack, researchers claim

Someone may be getting ready to attack Palo Alto Network devices, security researchers are warning after spotting a rise in activity.

Analysts from GreyNoise said they observed a “significant surge” in login scanning activity against the company’s PAN-OS GlobalProtect portals, with almost 24,000 unique IP addresses attempting to access these portals in March 2025.

“The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation,” the article reads. This could also mean that someone’s found a zero-day vulnerability in these endpoints and is now looking to see how many endpoints it can compromise through it.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)View Deal

Remote code execution risks

“Over the past 18 to 24 months, we’ve observed a consistent pattern of deliberate targeting of older vulnerabilities or well-worn attack and reconnaissance attempts against specific technologies,” said Bob Rudis, VP of Data Science at GreyNoise. “These patterns often coincide with new vulnerabilities emerging 2 to 4 weeks later.”

For GreyNoise, there is no doubt that this is a malicious campaign. Of the 24,000 unique IP addresses that scanned Palo Alto devices, 154 were labeled as “malicious” beyond reasonable doubt, while the rest were classified as “suspicious” in the past. Their locations are mostly in North America, throughout the US and Canada.

The majority of the targets are also based in the US.

GreyNoise says this activity could be linked to separate PAN-OS reconnaissance-related tags, such as PAN-OS Crawler, where they observed a single spike on March 26, 2025 involving 2,580 unique source IPs.

Obviously, the end goal is not known at this time, but vigilance is advised. IT teams should review their logs since mid-March to see if they were targeted, and should be on the lookout for signs of compromise. They should also harden their login portals and block known malicious IPs.

Via BleepingComputer

Palo Alto Networks PAN-OS sees authentication bypass under attack from hackers
We've rounded up the best password managers
Take a look at our guide to the best authenticator app