Coordinated Reconnaissance: 7,000+ IPs Target Palo Alto GlobalProtect and SonicWall API Endpoints

A security overview from GreyNoise notes a sudden surge in mass scanning that targeted Palo Alto Networks and SonicWall, raising alarms about potential reconnaissance activity. On 2 December 2025, GreyNoise sensors detected a concentrated spike of 7,000+ IPs probing Palo Alto Networks GlobalProtect login portals, described as intense but brief as attempts to reach VPN gateways.

Just 24 hours later, on 3 December, the same client fingerprints were observed scanning SonicWall SonicOS API endpoints (/api/sonicos), indicating a pivot in targeting. GreyNoise analysis traced the December 2 activity to infrastructure operated by 3xK GmbH, linking the two campaigns beyond timing.

The researchers noted identical fingerprints across the Palo Alto and SonicWall campaigns, suggesting a single actor or toolset moving between vendors to map vulnerable surfaces, with earlier activity in late September to mid-October connected to a much larger wave of scanning. According to GreyNoise, this re-emergence on 3xK infrastructure points to tooling continuity across what appear to be separate events.