Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign

GreyNoise has discovered that three exploitation campaigns targeting Cisco, Fortinet and Palo Alto Networks devices originate from IPs on the same subnets and share TCP fingerprints, indicating they are operated from the same infrastructure.

The threat intelligence firm initially warned of scanning attempts targeting Cisco ASA devices in early September, ahead of Cisco’s disclosure of two zero-day flaws (CVE-2025-20333 and CVE-2025-20362) affecting Secure Firewall ASA and FTD, which have been linked to the ArcaneDoor espionage campaign attributed to hackers based in China.

Last week GreyNoise flagged a massive increase in scans of Palo Alto Networks GlobalProtect login portals, with roughly 1,300 IPs involved, rising to about 2,200 unique IPs as more actors joined the activity. Over the past week there have been more than 1.3 million unique login attempts against Palo Alto firewalls, and a list of credentials used in the Fortinet campaign has been published.

GreyNoise notes that about 80% of spikes in firewall and VPN product activity from known vendors tend to precede disclosures of new vulnerabilities within six weeks. According to SecurityWeek, the three campaigns share subnets and timing, and GreyNoise says they are driven with high confidence by the same threat actor(s).