Attackers launch dual campaign on GlobalProtect portals and SonicWall APIs

A hacking campaign targeting Palo Alto Networks GlobalProtect portals and SonicWall API endpoints began on 2 December 2025, featuring login attempts against GlobalProtect portals and scans of SonicWall SonicOS API endpoints. According to GreyNoise, the activity originated from infrastructure operated by 3xK GmbH, a German hosting provider, with over 7,000 IPs involved in attempting to log into two Palo Alto GlobalProtect profiles.

The same three client fingerprints seen in earlier September–October waves reappeared on 3 December, now tied to SonicWall API scans, suggesting continuity in the attacker’s tooling across campaigns. GlobalProtect is Palo Alto Networks’ VPN and secure remote-access solution, and the report notes a pattern of intense login and brute-force activity from seemingly clean ASNs across the events.

GreyNoise observed a spike in SonicWall SonicOS API scans on 3 December, using the same fingerprints linked to the 2 December GlobalProtect surge, indicating cross-infrastructure relationships that defenders should monitor.