Coordinated Brute-Force Attacks Target Cisco and Palo Alto VPN Gateways

First seen 18 Dec 2025, 03:51 UTC • •42

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

In mid-December 2025, threat actors executed a brute-force campaign against Cisco SSL VPN and Palo Alto Networks GlobalProtect portals, conducting millions of automated login attempts. The attacks were traced back to infrastructure operated by Germany’s 3xK GmbH, utilizing scripted credential stuffing techniques instead of zero-day exploits.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 228d ago How this analysis works

Threat Graph

9 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Brute Force
Credential Stuffing
Data Breach
T1110 - Brute Force

Organization (3)

Cisco
Palo Alto
Palo Alto Networks

Affected Platform (2)

Cisco SSL VPN
GlobalProtect

Relationships

Brute Force targets Cisco SSL VPN
Brute Force targets GlobalProtect
Credential Stuffing targets Cisco SSL VPN
Credential Stuffing targets GlobalProtect
Data Breach targets Cisco SSL VPN
Data Breach targets GlobalProtect
T1110 - Brute Force targets Cisco SSL VPN
T1110 - Brute Force targets GlobalProtect
Brute Force related to Cisco
Brute Force related to Palo Alto
Brute Force related to Palo Alto Networks

Following this threat?

Track Cisco in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Coordinated Brute-Force Attacks Target Cisco and Palo Alto VPN Gateways

Article Content

More articles in this cluster (2)

Threat Graph

Following this threat?

Extracted Entities (10)

Attack Types (3)

Companies (3)

Countries (1)

MITRE ATT&CK (1)

Platforms (2)