Nearly 24,000 IPs behind wave of Palo Alto Global Protect scans

A significant spike in scanning activity targeting Palo Alto Network GlobalProtect login portals has been observed, with researchers concerned it may be a prelude to an upcoming attack or flaw being exploited. According to GreyNoise, which reports the activity, the scanning activity involves over 24,000 unique source IP addresses. The activity peaked at 20,000 unique IP addresses per day on March 17, 2025, and continued at this scale until March 26. Of those IPs, 23,800 are classified as "suspicious," while 154 were validated by the threat monitoring firm as "malicious," leaving little doubt about the activity's true intentions. Most of the scanning attempts originate from the United States and Canada. Most targeted systems are based in the United States, though other countries are targeted too. Observed scanning activity Source: GreyNoise GreyNoise noted that in the past, such spikes in network scanning have been linked to preparatory reconnaissance, which was eventually followe ... Read full article.