A persistent threat actor appears to be conducting low-and-slow password spraying against Palo Alto GlobalProtect VPN portals used by New Zealand retail organisations.
The activity is not particularly highly sophisticated nor noisy, with around 20 authentication attempts per hour observed overall. However, the activity has reportedly continued for several months, with periods of inactivity lasting a week or two before the attempts resume, so it is the persistence aspect to take note of.
Identifying the activity
One interesting characteristic of the activity is the device information presented in the GlobalProtect logs.
The following combination has always been observed:
devices.serialnumber— 10 hexadecimal charactersdevice.name— 10 hexadecimal charactersdevice.os—Microsoft Windows Server 2012 64-bit
The source IP addresses have also been notable. Rather than coming from a small number of fixed infrastructure addresses, the attempts originate from global consumer VPN IP addresses.
No individual IP address has generated more than two attempts within a five-minute period, helping the activity remain below thresholds that might otherwise generate obvious brute-force alerts.
The usernames are the interesting part
The actor is attempting a mixture of usernames belonging to former employees and usernames generated through what appears to be dictionary-based targeting.
The usernames generally follow formats such as:
firstname.lastname
or
firstname.lastname@example.com
Each campaign appears to reuse a proportion of previously attempted usernames while introducing approximately 10% previously unseen usernames.
One possibility is that the actor is working through old credential lists. Some of the usernames may originate from historic password or credential lists circulating on underground forums and dark-web sources, although this cannot be confirmed from the authentication activity alone.
For organisations with long employee histories, this is a useful reminder that old accounts and usernames can remain valuable to attackers even after an employee has left.
Why the low volume matters
At approximately 20 attempts per hour, this activity may not initially look like a significant brute-force attack.
That is potentially the point.
By spreading attempts across many consumer VPN addresses and keeping the number of attempts from each IP low, the actor can avoid looking like a conventional password-spraying campaign.
The activity is better characterised as persistent, distributed and low-and-slow.
The fact that it has continued for months, including periods where activity stops for one or two weeks, also suggests that organisations should not assume the threat has disappeared simply because authentication failures have temporarily stopped.
Watch how GlobalProtect responds
One area that deserves particular attention is the response generated by the Palo Alto GlobalProtect authentication process.
A failed username/password combination can produce a different response from a valid username and password that is then waiting for successful MFA.
That difference can provide an attacker with a useful indication that they have discovered a valid credential set, even though MFA may ultimately prevent the login.
Organisations should therefore work with their Palo Alto and identity-management teams to understand exactly what their GlobalProtect deployment exposes through authentication responses and whether those responses can be minimised or made less useful for account enumeration.
What should organisations do?
Security teams seeing similar activity should consider:
- Monitoring GlobalProtect authentication failures over longer periods rather than relying solely on hourly thresholds.
- Tracking username reuse across source IP addresses, rather than just blocking individual IPs.
- Reviewing attempts against former employees and disabled accounts.
- Looking for evidence that attempted usernames correspond to historical credential breaches.
- Ensuring MFA is enforced for every externally accessible VPN account.
- Reviewing whether GlobalProtect authentication responses disclose useful information about valid credentials.
- Alerting on unusual successful authentication followed by an MFA challenge.
- Correlating VPN authentication with Entra ID/Active Directory and endpoint telemetry.
- Reviewing whether legacy or unnecessary VPN accounts can be removed entirely.
The relatively low volume should not make this activity easy to dismiss. A threat actor does not need to generate thousands of authentication attempts if they can slowly work through a large credential list and occasionally find a valid password.
For NZ retailers running internet-facing VPN services, this is another example of why authentication telemetry needs to be monitored as a persistent threat rather than simply treated as a series of individual failed login events.
