Full Report
A spike in suspicious scans targeting Palo Alto Networks login portals indicates clear reconnaissance efforts from suspicious IP addresses, researchers warn. [...]
Analysis Summary
# Tool/Technique: Palo Alto Networks Login Portal Scanning
## Overview
A massive surge in reconnaissance activity involving suspicious IP addresses scanning Palo Alto Networks GlobalProtect and PAN-OS login portals. This activity suggests attackers are fingerprinting and identifying vulnerable network perimeter devices, potentially in preparation for exploitation.
## Technical Details
- Type: Technique (Reconnaissance/Scanning)
- Platform: Palo Alto Networks (PAN-OS, GlobalProtect portals)
- Capabilities: Fingerprinting network perimeter devices using recognized login portal paths (GlobalProtect, PAN-OS).
- First Seen: Activity surge reported on October 3, 2025.
## MITRE ATT&CK Mapping
- TA0011 - Command and Control
- T1046 - Network Service Scanning
- TA0043 - Reconnaissance
- T1595 - Active Scanning
- T1595.002 - Internet Service Scanning (Inferred from targeting specific public-facing login portals)
## Functionality
### Core Capabilities
- Identifying publicly exposed Palo Alto Networks management or VPN interfaces (GlobalProtect/PAN-OS).
- Utilizing potentially automated scripts or scanners (derived from public sources like Shodan/Censys) for mass targeting.
### Advanced Features
- Activity observed showed distinct TLS fingerprints between clusters, indicating segmentation or use of different automated scanning platforms by various actors, though some overlap existed.
## Indicators of Compromise
- File Hashes: N/A (Activity focuses on scanning, not malware delivery)
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: 1,285 unique IPs engaged in the activity on Oct 3, 2025.
- IPs largely geolocated in the U.S., with clusters in the U.K., Netherlands, Canada, and Russia.
- 91% of IPs classified as suspicious, 7% classified as malicious by GreyNoise.
- Behavioral Indicators: High volume of requests directed specifically at known Palo Alto login paths.
## Associated Threat Actors
- Unattributed suspicious/malicious actors engaged in automated reconnaissance.
## Detection Methods
- Signature-based detection: N/A (Depends on specific scanner signatures)
- Behavioral detection: Monitoring for a sharp increase in HTTP/HTTPS requests specifically targeting URLs associated with `GlobalProtect` or `PAN-OS` login endpoints across the network perimeter.
- YARA rules: N/A
## Mitigation Strategies
- Ensure all PAN-OS instances are fully patched, especially if the scanning precedes the announcement of new CVEs.
- Review firewall and IDS logs for spikes in scanning activity directed at GlobalProtect or PAN-OS portals.
- Restrict administrative access to management interfaces (PAN-OS/GlobalProtect) to trusted, known IP ranges where possible.
## Related Tools/Techniques
- Scanning activity often precedes exploitation of new or unpatched vulnerabilities (e.g., similar correlation noted previously with Cisco ASA scanning).
---
# Tool/Technique: CVE-2021-43798 Exploitation Attempts
## Overview
Observed exploitation attempts targeting an older, known path traversal vulnerability in Grafana, identified as CVE-2021-43798. This indicates actors are still attempting to exploit publicly known flaws remaining unpatched on internet-facing systems.
## Technical Details
- Type: Technique (Exploitation of known vulnerability)
- Platform: Grafana (Application Software)
- Capabilities: Path traversal to potentially read sensitive files from the server filesystem.
- First Seen: Coordinated exploitation attempts noted around September 28, 2025.
## MITRE ATT&CK Mapping
- TA0003 - Persistence
- TA0006 - Credential Access
- TA0010 - Exfiltration
- T1190 - Exploit Public-Facing Application
- T1190.004 - Exploit of Older Vulnerability / Known Vulnerability (Specific to CVE-2021-43798)
## Functionality
### Core Capabilities
- Executing path traversal requests against Grafana endpoints.
- Attempting to leak configuration files or other sensitive data residing outside the web application directory.
### Advanced Features
- The attacks demonstrated automation, keeping a consistent destination ratio depending on the origin.
## Indicators of Compromise
- File Hashes: N/A
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: 110 unique malicious IPs observed launching attacks (primarily from Bangladesh).
- Behavioral Indicators: Log entries showing abnormal path traversal sequences (e.g., sequences using `../` or similar file system navigation commands) directed at Grafana application paths.
## Associated Threat Actors
- Unattributed malicious actors engaged in automated exploitation campaigns.
## Detection Methods
- Signature-based detection: Block known malicious IPs associated with this wave.
- Behavioral detection: Monitor application access logs for unusual URI requests indicative of path traversal.
- YARA rules: N/A
## Mitigation Strategies
- Ensure Grafana instances are fully patched to remediate CVE-2021-43798.
- Review system logs for evidence of path traversal requests attempting to access system files.
- Block the identified malicious IP addresses.
## Related Tools/Techniques
- CVE-2021-43798 (Grafana Path Traversal vulnerability)