Cisco and Palo Alto Networks VPN gateways targeted in credential-based campaign

Rafi Mahmood

Observed in the wild

• On 17 December, GreyNoise disclosed a coordinated credential-based campaign targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect gateways, with over 1.7 million automated login attempts observed in 16 hours against GlobalProtect portals and a sharp surge against Cisco SSL VPN endpoints the following day.
• The campaign leveraged centralised infrastructure from hosting provider 3xK GmbH, using scripted password spraying and credential stuffing with uniform request patterns and atypical browser-like user agents, indicating large-scale automation rather than vulnerability exploitation.
• Organisations are advised to enforce strong password hygiene and MFA, audit VPN appliances for abnormal login activity, and block malicious IPs.

Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways