CampaignPublished 10 Oct 2025

Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign

Source SecurityWeek

Mentions 2 CVEs

Mentioned vulnerabilities

Description

GreyNoise has discovered that attacks exploiting Cisco, Fortinet, and Palo Alto Networks vulnerabilities are launched from the same infrastructure. The post Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign appeared first on SecurityWeek .

Impact

European organizations using Cisco ASA/FTD firewalls, Fortinet VPNs, and Palo Alto Networks firewalls face heightened risk of unauthorized access, data breaches, and network disruption. Successful exploitation could lead to espionage, data exfiltration, lateral movement within networks, and potential service outages. Critical infrastructure, government agencies, financial institutions, and large enterprises are particularly vulnerable due to their reliance on these security devices. The scale of brute force attempts and scanning increases the likelihood of credential compromise, especially where weak or reused passwords exist. Given the attribution to Chinese espionage groups, organizations involved in sensitive sectors or geopolitical activities may face targeted attacks. The campaign's early scanning activity also signals emerging zero-day vulnerabilities, requiring proactive defense to avoid exploitation. Disruption or compromise of firewall and VPN devices could undermine trust in network security and expose sensitive European data to foreign adversaries.

Defensive guidance

1. Immediately block and monitor IP addresses identified by GreyNoise and other threat intelligence sources as sources of scanning and brute force attempts. 2. Enforce strong, unique passwords and implement multi-factor authentication (MFA) on all firewall and VPN devices to mitigate credential stuffing risks. 3. Apply all available patches and updates from Cisco, Fortinet, and Palo Alto Networks promptly, especially for recently disclosed zero-days and critical vulnerabilities. 4. Harden firewall and VPN configurations by disabling unused services, restricting management access to trusted IPs, and enabling logging and alerting for anomalous login attempts. 5. Conduct regular vulnerability assessments and penetration testing focused on firewall and VPN appliances to identify and remediate weaknesses. 6. Deploy network segmentation and zero trust principles to limit lateral movement if a device is compromised. 7. Collaborate with national cybersecurity centers and share threat intelligence to stay informed of emerging indicators and attacker tactics. 8. Prepare incident response plans specifically for firewall and VPN compromise scenarios, including rapid isolation and forensic analysis. 9. Educate IT and security teams on recognizing signs of brute force and scanning activity and responding swiftly. 10. Consider deploying deception technologies to detect and divert attacker reconnaissance and brute force attempts.

References

securityweek.com/cisco-fortinet-palo-alto-networks-devices-targeted-in-coordinated-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Oct 2025, 12:52 UTC

References

Community reviews

Related threats