Barracuda Reports GlobalProtect Scanning and Remote-Access Threats
Summary
Barracuda’s SOC reports GlobalProtect scanning, credential-stuffing attempts against exposed VPN services, and a ScreenConnect RAT incident. It says scanning was blocked and an affected endpoint was isolated, and recommends patching, MFA, and tighter access controls.
Key points
- Barracuda detected two waves of scanning targeting publicly exposed GlobalProtect services in Belgium after CVE-2026-0257 was publicly reported; it says the attempts were blocked and no exploitation occurred.
- The article says exploitation of CVE-2026-0257 requires a configured GlobalProtect portal or gateway, enabled authentication override cookies, and specific certificate settings; it reports exploitation in the wild since May.
- Barracuda’s SOC detected credential stuffing against a customer’s Fortinet VPN and found firewall rules exposing SSL VPN, RDP, and Telnet to broad internet access.
- In a separate incident, attackers allegedly used unauthorized ScreenConnect clients for unattended remote access, with suspicious external communications and software placed in the Windows System32 directory.
- Barracuda says the endpoint involved in the ScreenConnect incident was isolated while investigators addressed persistence mechanisms.
- Recommended steps include applying vendor patches, restricting internet-facing remote access, enabling MFA, reviewing firewall rules, and monitoring for unusual authentication and remote-management activity.
Article Details
- Event Type
- Barracuda Research reported three security incidents or threat activities: scanning targeting exposed GlobalProtect services affected by CVE-2026-0257, credential-stuffing attempts against a customer's Fortinet remote-access VPN amid firewall misconfiguration, and abuse of ScreenConnect for persistent remote access to an endpoint.
- Impact
- The GlobalProtect scanning attempts were blocked, with no exploitation reported. The firewall misconfiguration exposed SSL VPN, RDP, and Telnet to broad internet access and attracted activity from multiple scanning clusters; no resulting compromise was specified. In the ScreenConnect incident, unauthorized clients enabled unattended access and communicated with suspicious external domains; the affected endpoint was isolated to disrupt access while investigators addressed persistence.
CVE
Vendors
BarracudaThe latest Barracuda Research findings on threats facing businessesConnectWiseThe SOC team identified an active Remote Access Trojan (RAT) incident involving the abuse of ScreenConnect (ConnectWise Control) software to establish persistent remote access on an endpoint.FortinetThe SOC team detected attackers attempting to access a customer's Fortinet remote-access VPN through credential stuffing (using compromised usernames and passwords stolen in previous breaches.)Palo Alto NetworksAccording to Palo Alto Networks, exploitation requires a GlobalProtect portal or gateway to be configured, authentication override cookies to be enabled, and specific certificate configuration related to those cookies.
Products
Barracuda Managed XDRIncidents mitigated in the last month by Barracuda Managed XDR highlight the continued risk of attackers exploiting trusted and legitimate software.GlobalProtectThis includes attackers scanning for vulnerable deployments of GlobalProtect, and the risk of misconfigured firewalls and exposed trusted remote services.ScreenConnectThe SOC team identified an active Remote Access Trojan (RAT) incident involving the abuse of ScreenConnect (ConnectWise Control) software to establish persistent remote access on an endpoint.