Automated Credential Campaign Targets VPN Services

Automated Credential Campaign Targets VPN Services

First seen 17 Dec 2025, 20:56 UTC •GreynoiseCybersecuritydiveBleepingcomputerLinkedinCsoonline •78% similarity •36.3

Article Content

Browse articles
ThreatCluster

GreyNoise is monitoring a coordinated credential-based attack campaign aimed at enterprise VPN authentication systems, specifically targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect services. The campaign involved large-scale scripted login attempts over a two-day period in mid-December, indicating a single entity leveraging consistent infrastructure across multiple platforms.

ThreatCluster AI

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Cisco Palo Alto Networks Sonicwall Cisco AsyncOS Cisco SSL VPN Cisco SSL VPNs GlobalProtect Pan-os Secure Email And Web Manager Brute Force Credential Stuffing