Unknown scanners probing Juniper and Palo Alto products
- GreyNoise reported mass probing of Palo Alto Networks' PAN-OS GlobalProtect login portals beginning March 17, 2025.
- This activity may be reconnaissance for an upcoming attack, as similar patterns preceded vulnerability disclosures.
- The scanning peaked around March 17, involving almost 20,000 unique IPs daily before tapering off around March 26.
- GreyNoise data showed 23,800 IPs as 'suspicious' and 154 IPs as 'malicious'; Bob Rudis stated about targeting patterns.
- GreyNoise advises administrators to review logs and harden login portals to prevent potential exploitation attempts.
11 Articles
11 Articles
Spike In Palo Alto Networks Scanner Activity Suggests Imminent Cyber Threats - Cybernoz - Cybersecurity News
Spike in Palo Alto Networks scanner activity suggests imminent cyber threats Pierluigi Paganini April 02, 2025 Hackers are scanning for vulnerabilities in Palo Alto Networks GlobalProtect portals, likely preparing for targeted attacks. Researchers at the threat intelligence firm GreyNoise warn of hackers that are scanning for vulnerabilities in Palo Alto Networks GlobalProtect portals, likely preparing for targeted attacks, warns…
24,000 unique IP addresses target PAN-OS GlobalProtect gateways
Attackers aim to find zero-days in the PAN-OS gateways they can exploit. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: 24,000 unique IP addresses target PAN-OS GlobalProtect gateways
Coverage Details
Bias Distribution
- 100% of the sources are Center
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage