---
title: Hackers Launch Massive Attack Campaign Against Palo Alto VPN Systems
description: Cybercriminals exploit Palo Alto VPN vulnerabilities via 7,000 IPs; urgent fixes advised by Palo Alto Networks and CISA.
canonical_url: https://codekeeper.co/ticker/cyberattack-on-palo-alto-vpn-globalprotect
---

# Hackers Launch Massive Attack Campaign Against Palo Alto VPN Systems

Cybercriminals exploit Palo Alto VPN vulnerabilities via 7,000 IPs; urgent fixes advised by Palo Alto Networks and CISA.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Dec 7, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are actively targeting Palo Alto Networks' GlobalProtect VPN portals using over 7,000 IP addresses worldwide. The attacks, detected in late November 2025, exploit vulnerabilities in internet-facing VPN gateways through UDP port 4501. Threat actors are using residential proxies and compromised servers across Asia, Europe, and North America to probe for weak configurations and deploy custom scripts. They're targeting historical flaws like CVE-2024-3400 and misconfigurations that allow unauthorized access. Palo Alto Networks issued an urgent advisory December 5, recommending multi-factor authentication and firewall restrictions. CISA added related indicators to its Known Exploited Vulnerabilities catalog, giving federal agencies 72 hours to patch. **Source:** [Cybersecurity News](https://cybersecuritynews.com/palo-alto-globalprotect-attacks/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcyberattack-on-palo-alto-vpn-globalprotect%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Klue Breach Expands: Dozens of Customers Compromised as Hackers Turn on Each Other Aug 12, 2026](https://codekeeper.co/ticker/klue-supply-chain-attack-exposes-data)

[Vulnerabilities CISA Flags Two Actively Exploited SonicWall SMA1000 Vulnerabilities Sep 3, 2026](https://codekeeper.co/ticker/sonicwall-sma1000-cisa-exploited-vulnerabilities)

[Cyberattacks UK Warns Power Companies After Cyberattack Takes Small Generator Offline Aug 25, 2026](https://codekeeper.co/ticker/uk-warns-power-firms-generator-cyberattack)

[Software security Apple Patches Actively Exploited Zero-Day in CoreGraphics Sep 29, 2026](https://codekeeper.co/ticker/apple-emergency-updates-fix-zero-day-flaw)