GreyNoise has identified a coordinated credential-based campaign abusing VPN login portals from Cisco and Palo Alto Networks.