Palo Alto Networks gateways facing huge number of possible security attacks

Security padlock in circuit board, digital encryption concept

(Image credit: Getty Images)

GreyNoise observed a spike in scanning throughout March 2025
Thousands of IP addresses were scanning PAN-OS GlobalProtect portals
These activities usually lead up to a cyberattack, researchers claim

Someone may be getting ready to attack Palo Alto Network devices, security researchers are warning after spotting a rise in activity.

Analysts from GreyNoise said they observed a “significant surge” in login scanning activity against the company’s PAN-OS GlobalProtect portals, with almost 24,000 unique IP addresses attempting to access these portals in March 2025.

“The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation,” the article reads. This could also mean that someone’s found a zero-day vulnerability in these endpoints and is now looking to see how many endpoints it can compromise through it.

Remote code execution risks

“Over the past 18 to 24 months, we’ve observed a consistent pattern of deliberate targeting of older vulnerabilities or well-worn attack and reconnaissance attempts against specific technologies,” said Bob Rudis, VP of Data Science at GreyNoise. “These patterns often coincide with new vulnerabilities emerging 2 to 4 weeks later.”

For GreyNoise, there is no doubt that this is a malicious campaign. Of the 24,000 unique IP addresses that scanned Palo Alto devices, 154 were labeled as “malicious” beyond reasonable doubt, while the rest were classified as “suspicious” in the past. Their locations are mostly in North America, throughout the US and Canada.

The majority of the targets are also based in the US.

GreyNoise says this activity could be linked to separate PAN-OS reconnaissance-related tags, such as PAN-OS Crawler, where they observed a single spike on March 26, 2025 involving 2,580 unique source IPs.

Obviously, the end goal is not known at this time, but vigilance is advised. IT teams should review their logs since mid-March to see if they were targeted, and should be on the lookout for signs of compromise. They should also harden their login portals and block known malicious IPs.

Palo Alto Networks acknowledged GreyNoise's findings and said it was keeping an eye on the developments. In a written statement shared with TechRadar Pro, it was said: "The security of our customers is always our top priority. Palo Alto Networks is aware of a recent blog posted by GreyNoise regarding scanning activity targeting PAN-OS GlobalPortect portals. Our teams are actively monitoring this situation and analyzing the reported activity to determine its potential impact and identify if mitigations are necessary."

"We encourage all customers to follow best practice of running the latest versions of PAN-OS."

Via BleepingComputer

Palo Alto Networks PAN-OS sees authentication bypass under attack from hackers
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.