GreyNoise Flags 90-Day High in Brute-Force Attempts on Palo Alto Portals

Du'aine Davis

Observed in the wild

• On GreyNoise detected a major surge in malicious activity targeting Palo Alto Networks GlobalProtect portals, starting 14 November 2025 and peaking with a 40× increase within 24 hours, marking a 90-day high. Over 2.3 million sessions attempted access to /global-protect/login.esp, primarily affecting organisations in the United States, Mexico, and Pakistan.
• The campaign leveraged brute-force login attempts and exhibited recurring TCP/JA4t fingerprints and shared infrastructure. Most traffic originated from AS200373 (3xK Tech GmbH) in Germany (62%) and Canada (15%), with secondary contributions from AS208885. Indicators suggest a coordinated threat actor reusing infrastructure across related campaigns.
• Organisations should block malicious IPs using custom blocklists, filtering by ASN, JA4 fingerprints, and suspicious classifications. For Microsoft Defender users, monitor for unusual login attempts to /global-protect/login.esp. Implement strict access controls and review Defender alerts for brute-force behaviour patterns.

Palo Alto Scanning Surges 40X in 24 Hours, Marking 90-Day High