Palo Alto Networks gateways facing huge number of possible security attacks

Date:
Wed, 02 Apr 2025 13:52:00 +0000

Description:
Activities like these usually lead up to the discovery of a new zero-day, experts warn.

FULL STORY ======================================================================GreyNois e observed a spike in scanning throughout March 2025 Thousands of IP
addresses were scanning PAN-OS GlobalProtect portals These activities usually lead up to a cyberattack, researchers claim

Someone may be getting ready to attack Palo Alto Network devices, security researchers are warning after spotting a rise in activity.

Analysts from GreyNoise said they observed a significant surge in login scanning activity against the companys PAN-OS GlobalProtect portals, with almost 24,000 unique IP addresses attempting to access these portals in March 2025.

The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to
targeted exploitation, the article reads. This could also mean that someones found a zero-day vulnerability in these endpoints and is now looking to see how many endpoints it can compromise through it.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnions advanced risk assessment tools.

Preferred partner ( What does this mean? ) View Deal Remote code execution risks

Over the past 18 to 24 months, weve observed a consistent pattern of deliberate targeting of older vulnerabilities or well-worn attack and reconnaissance attempts against specific technologies, said Bob Rudis, VP of Data Science at GreyNoise. These patterns often coincide with new vulnerabilities emerging 2 to 4 weeks later.

For GreyNoise, there is no doubt that this is a malicious campaign. Of the 24,000 unique IP addresses that scanned Palo Alto devices, 154 were labeled
as malicious beyond reasonable doubt, while the rest were classified as suspicious in the past. Their locations are mostly in North America, throughout the US and Canada.

The majority of the targets are also based in the US.

GreyNoise says this activity could be linked to separate PAN-OS reconnaissance-related tags, such as PAN-OS Crawler, where they observed a single spike on March 26, 2025 involving 2,580 unique source IPs.

Obviously, the end goal is not known at this time, but vigilance is advised. IT teams should review their logs since mid-March to see if they were targeted, and should be on the lookout for signs of compromise. They should also harden their login portals and block known malicious IPs.

Via BleepingComputer You might also like Palo Alto Networks PAN-OS sees authentication bypass under attack from hackers We've rounded up the best password managers Take a look at our guide to the best authenticator app



======================================================================
Link to news story: https://www.techradar.com/pro/security/palo-alto-networks-gateways-facing-huge -number-of-possible-security-attacks


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)