Threat intelligence researchers reported a massive spike in scanning activity targeting Palo Alto Networks login portals, marking a nearly 500% increase in observed attempts on October 3, 2025 — the highest level recorded in three months. The activity, described as targeted and structured, involved around 1,300 unique IP addresses, up from roughly 200 previously observed. Researchers classified 93% of the IPs as suspicious and 7% as malicious, with most originating from the U.S., and smaller clusters found in the U.K., Netherlands, Canada, and Russia.

The researchers noted similarities between this spike and recent Cisco ASA scanning activity, which occurred within the same 48-hour period. Both exhibited regional clustering and shared TLS fingerprints linked to infrastructure in the Netherlands, suggesting potentially coordinated reconnaissance or exploit preparation.

In response, Palo Alto Networks stated that it found no evidence of compromise following an internal investigation. The company emphasized that customer security remains its top priority and highlighted its Cortex XSIAM platform, which blocks 1.5 million attacks daily and filters billions of events to isolate critical threats, ensuring its network remains secure.

This surge follows a similar event in April 2025, when researchers observed suspicious scans targeting Palo Alto Networks PAN-OS GlobalProtect gateways, prompting the vendor to urge customers to update to the latest software versions.

Researchers also noted that such spikes in scanning, brute-forcing, or exploit attempts are often precursors to new CVE disclosures, typically within six weeks. A comparable trend was seen in August–September 2025, when widespread scanning of Cisco ASA devices preceded the disclosure of two zero-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) exploited in real-world malware campaigns.

Data from the security firm shows over 45,000 Cisco ASA/FTD systems remain vulnerable, underscoring the ongoing risks of delayed patching and coordinated scanning activity across enterprise network products.