Palo Alto Networks gateways facing huge number of possible security attacks

• GreyNoise observed a spike in scanning throughout March 2025
• Thousands of IP addresses were scanning PAN-OS GlobalProtect portals
• These activities usually lead up to a cyberattack, researchers claim

Someone may be getting ready to attack Palo Alto Network devices, security researchers are warning after spotting a rise in activity.

Analysts from GreyNoise said they observed a “significant surge” in login scanning activity against the company’s PAN-OS GlobalProtect portals, with almost 24,000 unique IP addresses attempting to access these portals in March 2025.

“The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation,” the article reads. This could also mean that someone’s found a zero-day vulnerability in these endpoints and is now looking to see how many endpoints it can compromise through it.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

Remote code execution risks

“Over the past 18 to 24 months, we’ve observed a consistent pattern of deliberate targeting of older vulnerabilities or well-worn attack and reconnaissance attempts against specific technologies,” said Bob Rudis, VP of Data Science at GreyNoise. “These patterns often coincide with new vulnerabilities emerging 2 to 4 weeks later.”

For GreyNoise, there is no doubt that this is a malicious campaign. Of the 24,000 unique IP addresses that scanned Palo Alto devices, 154 were labeled as “malicious” beyond reasonable doubt, while the rest were classified as “suspicious” in the past. Their locations are mostly in North America, throughout the US and Canada.

The majority of the targets are also based in the US.

GreyNoise says this activity could be linked to separate PAN-OS reconnaissance-related tags, such as PAN-OS Crawler, where they observed a single spike on March 26, 2025 involving 2,580 unique source IPs.

Obviously, the end goal is not known at this time, but vigilance is advised. IT teams should review their logs since mid-March to see if they were targeted, and should be on the lookout for signs of compromise. They should also harden their login portals and block known malicious IPs.

Palo Alto Networks acknowledged GreyNoise's findings and said it was keeping an eye on the developments. In a written statement shared with TechRadar Pro, it was said: "The security of our customers is always our top priority. Palo Alto Networks is aware of a recent blog posted by GreyNoise regarding scanning activity targeting PAN-OS GlobalPortect portals. Our teams are actively monitoring this situation and analyzing the reported activity to determine its potential impact and identify if mitigations are necessary."

"We encourage all customers to follow best practice of running the latest versions of PAN-OS."

Via BleepingComputer

You might also like

• Palo Alto Networks PAN-OS sees authentication bypass under attack from hackers
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app