Automated VPN credential attacks are escalating across enterprise portals

At a glance

What this is: GreyNoise is describing a coordinated automated credential campaign against enterprise VPN authentication infrastructure, driven by scripted login attempts rather than vulnerability exploitation.

Why it matters: IAM and security teams should read this as a control problem around authentication hardening, MFA enforcement, and exposure management at remote access edges, including systems that carry privileged access into enterprise environments.

By the numbers:

• GreyNoise observed approximately 1.7 million sessions over a 16-hour period against GlobalProtect portals.
• Daily unique attacking IPs rose from fewer than 200 to 1,273 on Cisco SSL VPN endpoints.

Context

Enterprise VPN portals remain a concentrated authentication boundary, and when attackers can automate login attempts at scale, the issue is not just volume but the quality of the access controls that sit in front of remote entry points. This is a governance problem as much as a detection problem: weak passwords, absent MFA, and unmanaged accounts turn perimeter systems into high-yield authentication targets.

The activity GreyNoise describes is not evidence of a software flaw being exploited. It is a credential pressure campaign aimed at finding exposed or weakly protected portals, which makes VPN identity controls a direct concern for IAM, PAM, and remote-access governance. Treat remote access identity as part of the control plane, not an afterthought around the network edge.

Key questions

Q: What breaks when VPN portals are exposed to automated credential attacks?

A: The failure is not usually the VPN protocol itself. What breaks is the trust boundary around authentication, especially when portals accept repeated login attempts, weak passwords, or accounts without MFA. Automated campaigns can turn a remote access edge into a scalable entry path, making identity assurance and rate control the real control points.

Q: Why do weak VPN authentication controls create such broad enterprise risk?

A: Weak VPN authentication creates broad risk because a successful login often places an attacker inside the internal network boundary. From there, they may reach applications, file shares, databases, and administrative paths that were never meant to be exposed externally. Credential stuffing, brute force, and session hijacking become especially dangerous when access is not constrained by role or device trust.

Q: What signs show that VPN login activity is part of an automated campaign?

A: Look for repeated request structures, common user agents, short bursts of session creation, shared source infrastructure, and login attempts spread across multiple portals with the same timing pattern. Those signals point to scripted credential abuse rather than normal interactive use.

Q: How should teams respond when remote access credentials may be under attack?

A: Tighten MFA enforcement, review authentication logs for unusual login volume, and remove dormant or shared accounts that can be sprayed at scale. Where possible, segment administrative access from standard user VPN access so that one successful login cannot immediately broaden the attacker’s reach.

Technical breakdown

Why scripted VPN login attacks scale so effectively

Automated login campaigns work by replaying standard authentication workflows at high speed across many endpoints. The attacker does not need a vulnerability if the portal accepts repeated username and password checks, and if the infrastructure tolerates large numbers of sessions without strong friction. Common usernames, password spraying, and credential stuffing all exploit the same weakness: authentication paths that are reachable, predictable, and only weakly rate-limited. In this model, the portal itself is the target, because every successful login is a low-cost win for the attacker and a high-value trust event for the defender. See the VPN Security Guide.

Practical implication: Validate remote access controls under automated load, not just normal user traffic.

How infrastructure fingerprinting reveals a coordinated campaign

GreyNoise highlights reused TCP fingerprints, a consistent user agent, and shared hosting infrastructure as indicators that the activity is centrally coordinated rather than opportunistic end-user behaviour. That matters because campaign linkage changes how defenders prioritise response: a single source infrastructure can be blocked, while the underlying access pattern may continue through adjacent VPN brands or related authentication services. Consistency also suggests tooling discipline, where the attacker is standardising request structure to fit login workflows and avoid noisy anomalies that trigger simpler detections.

Practical implication: Use request fingerprinting and infrastructure clustering to separate one campaign from isolated login noise.

What the login workflow tells defenders about attack intent

The observed request bodies followed standard SSL VPN authentication sequences, including CSRF token handling and parameterized username and password fields. That means the attacker was interacting with the application as designed, not crashing it or probing an exploit chain. When login attempts look like normal traffic, the defender has to focus on trust signals around identity, session initiation, and source reputation. This is where VPN authentication becomes an identity governance issue: a valid-looking session can still be malicious if the credential set is compromised or guessed. See the Remote Access Identity Guide.

Practical implication: Instrument authentication telemetry closely enough to distinguish valid protocol use from hostile credential attempts.

Threat narrative

Attacker objective: Gain authenticated remote access through compromised or weak VPN credentials and use that foothold for further internal access.

1. Entry begins with automated login attempts against exposed enterprise VPN portals using common credentials and scripted request patterns.
2. Credential access is pursued through password spraying and credential stuffing, not by exploiting a software vulnerability.
3. Escalation occurs if a weak or reused credential succeeds, giving the attacker a foothold through a trusted remote access channel.
4. Impact is potential unauthorised access to enterprise networks and downstream systems that trust the VPN session.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential pressure on VPN portals is now a governance problem, not just a brute-force nuisance. When a portal is reachable from the internet, the control question is whether identity assurance is strong enough to resist automated reuse, guessing, and spraying at scale. The same risk appears across different VPN brands because the weakness sits in the access pattern, not the product name. Practitioners should treat remote access authentication as a governed trust boundary, not a technical convenience.

Remote access identity must be managed as a lifecycle, not a static configuration. The article shows how quickly a campaign can pivot across Cisco SSL VPN and Palo Alto Networks GlobalProtect while keeping the same infrastructure and login logic. That is a reminder that dormant accounts, shared credentials, and weak MFA discipline create reusable attack surface across the remote access estate. Remote access identity controls matter because the attacker is targeting the identity path into the environment, not the service banner itself.

Automated login campaigns expose an access assurance gap: the environment may know the portal is reachable, but not whether the login attempt is human, scripted, or already compromised. The repeated user agent, consistent timing, and shared hosting infrastructure are all signs that traditional perimeter assumptions are too coarse for modern authentication telemetry. Teams need to move from blocking obvious bad IPs to governing the quality of each authentication event.

VPN authentication remains a prime example of where NHI and human identity controls intersect. The accounts being attacked are human access paths, but the operational response depends on treating passwords, MFA, device trust, and privileged session entry as one control surface. Where VPN access is also used for administrators or third parties, the blast radius of a successful login grows quickly. That makes remote access an IAM and PAM issue as much as a network one.

Campaign linkage across products should change how defenders think about category boundaries. A VPN login spray that shifts from GlobalProtect to Cisco SSL VPN is not two unrelated events. It is one access strategy moving between enforcement points, which means analytics, rate limiting, and identity policy must be evaluated across the whole remote access estate. The practical conclusion is simple: measure authentication resilience as a cross-platform control, not a per-device feature.

What this signals

Credential spraying against VPN portals is a sign that authentication governance is still being treated as an edge problem. When attackers can pivot across brands and preserve the same login logic, the right defence is not simply more blocking. It is stricter control over who can authenticate, from where, and under what assurance level, with remote access treated as part of the identity programme.

Remote access environments need control validation, not only configuration review. A portal can be patched, hardened, and still remain vulnerable to high-volume login abuse if MFA coverage, dormant account removal, and authentication telemetry are uneven. The practical shift is to measure how well the access control performs under adversarial traffic, not just whether the device is online.

For practitioners

• Harden remote access authentication Require MFA on every externally reachable VPN portal and enforce strong password policy for all remote access identities, including administrative and third-party accounts.
• Audit VPN exposure and login patterns Review Cisco and Palo Alto VPN logs for unusual session spikes, repeated username combinations, and source concentration from cloud hosting ranges that do not match your normal user base.
• Reduce reusable credential risk Identify accounts that can still authenticate through older remote access paths, remove dormant access, and eliminate shared credentials that can be sprayed across portals.
• Improve detection of automated authentication Correlate user agent consistency, request timing, and failed login volume so that scripted credential attempts are separated from ordinary remote user traffic.

Key takeaways

• The core issue is credential abuse at the authentication layer, not exploitation of a VPN software flaw.
• The article shows that coordinated login activity can spread across multiple VPN platforms while reusing the same infrastructure and request patterns.
• Defenders need to tighten MFA, remove dormant access, and validate remote access controls against automated login pressure, not just normal user traffic.

Related NHI Mgmt Group resources: Remote Access Identity Guide · VPN Security Guide · Breach and Attack Simulation (BAS) Guide · Guide to the Secret Sprawl Challenge

Key terms

• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Remote Administrator Authentication: Remote administrator authentication is the process by which a device validates privileged users through an external identity source such as RADIUS or SSO. It centralises control, but it also creates a shared failure domain if the device accepts credentials incorrectly or exposes the admin path too broadly.
• Authentication Telemetry: Authentication telemetry is the record of signups, logins, returning sessions, and other identity events generated by an auth system. It becomes useful when teams translate those events into operational signals for adoption, lifecycle health, and risk review rather than leaving them as raw logs.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in a way that helps practitioners connect identity controls to real operational risk. It gives security and IAM teams a common language for governing access paths that now include both human users and non-human actors.