Hackers Actively Attacking Cisco and Palo Alto Networks VPN Gateways to Gain Login Access

Cybersecuritynews •Guru Baran • December 18, 2025

Threat actors launched a coordinated brute-force campaign against enterprise VPN gateways, hammering Palo Alto Networks GlobalProtect portals and Cisco SSL VPN endpoints with millions of automated login attempts in mid-December 2025. GreyNoise intelligence revealed the attacks stemmed from centralized infrastructure hosted by Germany’s 3xK GmbH, using scripted credential stuffing rather than zero-day exploits. The operation […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Coordinated Brute-Force Attacks Target Cisco and Palo Alto VPN Gateways In mid-December 2025, threat actors executed a brute-force campaign against Cisco SSL VPN and Palo Alto Networks GlobalProtect portals, conducting millions of automated login attempts. The attacks were traced back to infrastructure operated by Germany’s 3xK GmbH, utilizing scripted credential stuffing techniques instead of zero-day exploits. 2 sources 42

Extracted Entities

Hackers Actively Attacking Cisco and Palo Alto Networks VPN Gateways to Gain Login Access

The full story

Extracted Entities

Attack Types (2)

Companies (2)

Countries (1)

MITRE ATT&CK (1)

Platforms (2)