Surge in Malicious Traffic Targeting Palo Alto Networks' GlobalProtect

First seen 20 Nov 2025, 16:18 UTC • Theregister

•24

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

On November 14, 2025, malicious traffic aimed at Palo Alto Networks' GlobalProtect portals surged nearly 40-fold, reaching a 90-day high. This spike, which involved approximately 2.3 million sessions targeting the 'global-protect/login.esp' endpoint, primarily originated from a single network, AS200373 (3xK Tech GmbH).

How this analysis works

Attack Flow

Continue Reading

Critical Check Point VPN Vulnerability Exploited by Ransomware Gang Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks Palo Alto Cortex XSOAR Vulnerability in Microsoft Teams Integration Exposed Critical Vulnerabilities Disclosed in Palo Alto Networks PAN-OS Software GreyNoise Report Reveals Early Warning Signals for Edge Device Vulnerabilities Vulnerability in Google Cloud's Vertex AI Exposes Sensitive Data to Attackers

Surge in Malicious Traffic Targeting Palo Alto Networks' GlobalProtect

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading