Password Spraying Attacks Target Cisco and Palo Alto Networks VPN Gateways

Recent automated password spraying attacks have been observed targeting both Cisco SSL VPN and Palo Alto Networks GlobalProtect platforms. On December 11, GreyNoise reported that login attempts on GlobalProtect reached a staggering 1.7 million within a 16-hour window, originating from more than 10,000 unique IP addresses. This activity primarily came from the 3xK GmbH IP space in Germany, indicating a centralized infrastructure behind the attacks.

Following this, on December 12, similar probing activity was detected against Cisco SSL VPN endpoints, with unique attack IPs increasing to 1,273, significantly above the normal baseline of fewer than 200. These attacks utilized common username and password combinations, suggesting a scripted approach to identify weakly protected portals rather than exploiting vulnerabilities.

While Cisco recently warned of a zero-day vulnerability (CVE-2025-20393) in its AsyncOS, GreyNoise found no evidence linking the observed credential-based attacks to this specific vulnerability. Palo Alto Networks confirmed awareness of the activity and emphasized that it reflects automated credential probing rather than any compromise of their systems.

This series of attacks underscores the persistent threat to enterprise VPN authentication endpoints, particularly during periods of heightened cyber activity. Organizations must remain vigilant, as attackers increasingly target weak credentials to gain unauthorized access.

Practical Implications for Users and Organizations

For everyday users and organizations, these incidents highlight the importance of strong password practices and the implementation of multi-factor authentication (MFA). As attackers continue to exploit weak credentials, it is critical to ensure that all accounts, especially those related to VPN access, are secured with complex passwords.

Organizations should regularly audit their network appliances for unexpected login attempts and consider blocking known malicious IP addresses associated with these probing activities. Staying informed about emerging threats and adjusting security measures accordingly can significantly reduce the risk of unauthorized access.

In summary, the ongoing password spraying attacks targeting Cisco and Palo Alto Networks VPN gateways serve as a reminder of the evolving landscape of cyber threats. By taking proactive steps to enhance security, users and organizations can better protect themselves against similar attacks in the future.