Massive Global Scanning Campaign Targets Palo Alto Networks GlobalProtect VPN Portals

What happened

Security monitors have observed a sudden and sustained surge in automated scanning activity directed at GlobalProtect login endpoints. The probes consist of millions of sessions concentrated on the portal login path, where attackers appear to be identifying exposed VPN portals and testing for weaknesses. The volume and distribution of the scans suggest this is not random internet noise but coordinated reconnaissance aimed at finding reachable, potentially vulnerable remote access portals.

Why this is worrying

Remote access portals are a high-value target because they serve as the gateway for legitimate users to reach corporate networks. If an attacker can harvest credentials or trick users into revealing authentication factors, they can pivot into internal systems. A vulnerability that allows the injection of malicious scripts into a portal page raises the risk of convincing-looking phishing pages and browser-based credential theft. Even absent a direct software exploit, large-scale scanning commonly precedes targeted attacks and exploitation campaigns.

Attack techniques to watch for

• Automated probes that enumerate portal endpoints and look for characteristic responses or banners.
• Attempts to serve or deliver crafted links that could exploit client-side weaknesses in portal pages.
• Credential stuffing and brute force login attempts following the discovery of accessible authentication endpoints.
• Use of distributed hosting and many distinct IP addresses to evade simple blocklists and to complicate attribution.

Immediate actions for defenders

Security teams should assume their exposed VPN portals may be scanned and take defensive measures that reduce the likelihood of compromise. Recommended immediate steps include:

• Verify patch status: Ensure firewall and VPN software are updated to the latest supported releases that address known portal vulnerabilities.
• Harden portal configuration: Disable clientless access if it is not required and limit unnecessary features that expand the attack surface.
• Enforce strong authentication: Require multi-factor authentication for all VPN logins and consider stronger forms of second factors where possible.
• Monitor and alert: Enable detailed logging for portal access, watch for spikes in failed logins, and create alerts for unusual traffic patterns directed at authentication endpoints.
• Apply network controls: Use access control lists and geo or ASN filters as appropriate, and integrate reputable threat intelligence feeds to block known scanning sources.
• Review web protections: Apply web application firewall rules, content security policies, and vulnerability protection profiles to the portal interface to reduce the risk of client-side attacks.

Longer term defensive measures

Beyond immediate hardening, organizations should adopt a layered approach to protect remote access services.

• Adopt zero trust principles that minimize implicit trust for devices and sessions originating from remote access.
• Segment remote access so that successful credential use provides only the minimum required privileges.
• Regularly run internal red team or purple team exercises that emulate reconnaissance and phishing against the portal to validate detection and response controls.
• Keep an active incident response and threat hunting capability to rapidly investigate signs of compromise or suspicious authentication patterns.

How organizations can triage and investigate

When scanning is detected, triage should focus on identifying scope and signs of successful exploitation. Key investigative steps include:

• Correlate portal logs with VPN gateway logs to find successful sessions tied to unusual source IPs or device fingerprints.
• Search for anomalous post-authentication activity, such as unexpected administrative actions or unusual lateral movement.
• Check for indicators of credential harvesting, including unusual referrer headers, unexpected JavaScript loads, or modified portal content.
• Preserve logs and capture network traffic where feasible to support forensic analysis.