Palo Alto Networks has revealed that it is observing brute-force login makes an attempt in opposition to PAN-OS GlobalProtect gateways, days after menace actors warned of a surge in suspicious login scanning exercise focusing on its home equipment.
“Our groups are observing proof of exercise in step with password-related assaults, akin to brute-force login makes an attempt, which doesn’t point out exploitation of a vulnerability,” a spokesperson for the corporate advised The Hacker Information. “We proceed to actively monitor this example and analyze the reported exercise to find out its potential impression and determine if mitigations are needed.”
The event comes after menace intelligence agency GreyNoise alerted of a spike in suspicious login scanning exercise aimed toward PAN-OS GlobalProtect portals.
The corporate additional famous that the exercise commenced on March 17, 2025, hitting a peak of 23,958 distinctive IP addresses earlier than dropping off in direction of the tip of final month. The sample signifies a coordinated effort to probe community defenses and determine uncovered or susceptible techniques.
The login scanning exercise has primarily singled out techniques in the USA, the UK, Eire, Russia, and Singapore.
It is at the moment not recognized how widespread these efforts are and if they’re the work of any particular menace actor at this stage. The Hacker Information has reached out to Palo Alto Networks for extra feedback, and we’ll replace the story if we hear again.
Within the interim, all clients are inspired to make sure that they’re operating the newest variations of PAN-OS. Different mitigations embody imposing multi-factor authentication (MFA), configuring GlobalProtect to facilitate MFA notifications, establishing security policies to detect and block brute-force attacks, and limiting unnecessary exposure to the web.
Source link