New Cyber Threat Targets Palo Alto GlobalProtect VPN and SonicWall API

A significant uptick in login attempts and scanning activities directed at Palo Alto GlobalProtect portals and SonicWall API endpoints has been reported.

Key Points:

• The attacks began on December 2nd and involved over 7,000 IP addresses linked to 3xK GmbH.
• Initial attempts targeted GlobalProtect portals with brute force methods before shifting focus to SonicWall API scanning.
• Previous activity was observed with the same client fingerprints in late September and mid-October, indicating a persistent threat actor.
• Palo Alto Networks confirmed that the incidents represent credential-based attacks and highlighted the importance of Multi-Factor Authentication.

Recent cybersecurity monitoring has revealed a coordinated campaign targeting Palo Alto Networks' GlobalProtect VPN solution. Starting on December 2nd, attacks originated from a vast network of over 7,000 IP addresses belonging to the German IT infrastructure provider 3xK GmbH. Initial login attempts at the GlobalProtect portals utilized brute force tactics, where attackers repetitively input various credential combinations in an effort to gain unauthorized access. These efforts escalated quickly, leading to subsequent scanning activities aimed at the SonicWall SonicOS API endpoints—a critical aspect of network management for many organizations.

The threat actor displayed consistent behavior by utilizing the same client fingerprints seen in earlier scanning attempts, suggesting a methodical approach to identify potential vulnerabilities. Notably, two profiles feeding into Palo Alto's sensor network indicated that these login attempts were highly organized, generating millions of non-spoofable HTTP sessions. Although Palo Alto Networks reassured customers that their services are not compromised, they emphasized the necessity for organizational defenses, especially the implementation of Multi-Factor Authentication, to curb credential abuse effectively and mitigate risks associated with such attacks.

What steps do you think organizations should take to enhance their cybersecurity in light of this campaign?

Learn More: Bleeping Computer

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)