@greynoise we saw similar activity last year at xmas and attackers would use first initial last name combinations en masse with lists of common passwords. 8.3 million attempts in 28 hrs. Over 10k+ source IPs that they would rotate across. If they discovered a valid username password combo they would attempt pass code mfa option to brute force it. Passcode as mfa option would not notify user that their account was being attacked and was not subject to lockout like push is so you could bruteforce mfa passcodes. Only a million attempts for a 6 digit passcode. This appears to have been fixed by some major mfa providers this year as we see passcode now locking accounts after repeat failures. Don't publish Global Protect web interface to the internet. Require GP client, cert before allowing auth. They also went after Netscalers in the same time frame. Tis the season...