In recent weeks, a series of cyberattacks targeting corporate VPNs has been detected, highlighting a reconnaissance strategy orchestrated by cybercriminals. These attacks exploit legitimate infrastructures to map exposed VPN access, once again underscoring the need for increased vigilance in protecting corporate networks.
The 3 key points not to miss
- Since early December, an increase in login attempts has been observed on Palo Alto’s GlobalProtect portals and SonicWall APIs.
- More than seven thousand IP addresses, originating from the infrastructure of 3xK GmbH, have been involved in these attacks.
- GreyNoise has identified recurring technical signatures, suggesting an ongoing operation to map VPN access and firewalls.
Attacks on VPN portals
In early December, a notable increase in login attempts was observed on GlobalProtect portals, a widely used VPN service in companies. These attacks mainly originated from the infrastructure of 3xK GmbH, a legitimate provider whose servers were hijacked to conduct this coordinated operation.
Although this may seem like an isolated incident, analysts quickly identified a recurring pattern, already observed between September and October. The same technical signatures were noted, despite a complete change of infrastructure, indicating a continuous reconnaissance effort by cybercriminals.
Un vide-dressing occasionnel rapporte rarement plus de 200 € par mois. Mais l'écart avec les vendeurs les plus performants est plus large qu'on ne le pense : 300 à 900 €/mois pour une activité régulière (2 à 5h/semaine), et 1 000 à 2 500 €+/mois pour les profils qui traitent Vinted comme un vrai canal de vente structuré. La différence ne tient ni à la chance ni à la taille du dressing de départ : elle tient presque entièrement à la méthode (algorithme, pricing, réactivité) appliquée avec régularité.
Avec 📘 Le Guide Vinted, transformez ce canal en revenu complémentaire structuré, voire en une vraie activité e-commerce.
Une méthode complète pour décoder l'algorithme, optimiser vos annonces comme une landing page, automatiser votre relance commerciale et sécuriser votre activité sur le plan fiscal.
🧠 Les 5 facteurs qui pilotent la visibilité de vos annonces (logique proche du SEO)
📈 Une méthode réplicable pour passer d'une activité occasionnelle à un revenu récurrent
⚖️ Statut, fiscalité, professionnalisation : rester en règle en montant en volume
🚫 Le chapitre que personne n'aborde ailleurs : comprendre et prévenir les blocages de compte
Expanded targeting to SonicWall firewalls
On December 3, the attacks evolved to also target the management interfaces of SonicWall firewalls. The same technical footprints were used, reinforcing the hypothesis of a single actor expanding its scope. This evolution highlights the growing interest of cybercriminals in online security devices.
The attacks do not reveal immediate vulnerabilities, but they highlight the essential role of VPNs and firewalls in network protection. This requires continuous monitoring to detect abnormal behaviors and adjust security policies accordingly.
Recommendations to strengthen security
In the face of this persistent threat, network administrators are encouraged to strengthen the control of their VPN and firewall authentication surfaces. Implementing multi-factor authentication is strongly recommended to reduce the effectiveness of attacks based on compromised credentials.
Furthermore, using unique and strong passwords can prevent the exploitation of credential leaks. Careful monitoring of repeated login attempts is crucial to early detection of this type of campaign and minimizing its potential impact.
Background and history of Palo Alto and SonicWall
Palo Alto Networks is an American company founded in 2005, specializing in cybersecurity. It is known for its innovative network protection solutions, including its firewalls and VPN services, which are widely adopted worldwide.
SonicWall, on the other hand, is a company that was established in 1991 and has become a major player in the field of IT security solutions. Its firewalls and intrusion prevention systems are used by many companies to protect their digital infrastructures against external threats.