Cisco SSL VPN is a technology platform tracked across 4 threat clusters and 5 intelligence report mentions on ThreatCluster. First observed December 17, 2025; most recent activity April 20, 2026.
Cisco SSL VPN is Cisco's secure remote access VPN gateway platform that provides web-based authentication and SSL/TLS-based connectivity for remote users. It is a high-value, internet-facing gateway commonly used to reach internal networks, making it a frequent target for credential-based intrusion attempts. Recent reporting indicates attackers are focusing on gaining login access to VPN gateways, highlighting the platform's critical role as an initial access point in cybersecurity incidents.
GreyNoise Intelligence has released a report indicating that spikes in malicious activity often precede the disclosure of new vulnerabilities in edge devices. The study tracked 147.8 million sessions over 103 days,…
In mid-December 2025, threat actors executed a brute-force campaign against Cisco SSL VPN and Palo Alto Networks GlobalProtect portals, conducting millions of automated login attempts. The attacks were traced back to…
GreyNoise is monitoring a coordinated credential-based attack campaign aimed at enterprise VPN authentication systems, specifically targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect services. The campaign…
The 2026 GreyNoise State of the Edge Report indicates that over half of the most dangerous exploitation attempts against internet-facing infrastructure originated from IPs with no prior history in GreyNoise data. The…