GreyNoise detected a surge of 7,000+ IPs attempting to log into GlobalProtect, sharing fingerprints with a surge in SonicWall API scanning and earlier Palo Alto campaigns, exposing a persistent credential-based attack pattern.
A Hidden Pattern Within Months of Credential-Based Attacks Against Palo Alto GlobalProtect
calendar_today
December 4, 2025
domain
greynoise