A little more than one week after SC Media reported that there was a spike in suspicious logging activity aimed at Palo Alto Networks PAN-OS GlobalProtect portals, Palo Alto has confirmed that it observed brute-force login attempts against these devices.
However, Palo Alto underscored that while its teams are observing evidence of password-related brute force login attacks, it does not indicate exploitation of a vulnerability.
“Palo Alto Networks is aware of a recent blog post by GreyNoise regarding scanning activity targeting PAN-OS GlobalProtect portals,” a Palo Alto spokesperson told SC Media. “We continue to actively monitor this situation and analyze the reported activity to determine its potential impact and identify if mitigations are necessary.”
Here’s why this development is important to security teams: In a brute-force attack, threat actors repeatedly log into an account using many user names and passwords until they find the correct combination. Once an attacker finds the right credential, they can access these networking devices and then either move laterally to continue other malicious activities, or sell the stolen credentials on the dark web.
Boris Cipot, senior security engineer at Black Duck, added that while most Palo Alto customers have probably updated their PAN-OS systems and mitigated their vulnerabilities, it does not mean that everyone has.
“Therefore, the attackers are likely trying to see who has missed the mark and ‘forgot’ to do the necessary basic actions needed to keep their organization safe,” said Cipot.
Here’s a list of the basic actions Cipot recommends for security teams:
