THREATOPS

THREAT OPS › Threat News › A Hidden Pattern Within Months of Credential-Based Attacks Against Palo Alto GlobalProtect

A Hidden Pattern Within Months of Credential-Based Attacks Against Palo Alto GlobalProtect

infogreynoise_blogPublished 2025-12-04

GreyNoise detected a surge of 7,000+ IPs attempting to log into GlobalProtect, sharing fingerprints with a surge in SonicWall API scanning and earlier Palo Alto campaigns, exposing a persistent credential-based attack pattern.

Original source: https://www.greynoise.io/blog/hidden-pattern-credential-based-attacks-palo-alto-sonicwall