Loading story…
A significant internet-wide scanning campaign was observed over the 2025 Christmas holiday, where a single operator systematically probed for vulnerable systems using more than 240 different exploits. The attacker leveraged ProjectDiscovery's Interactsh platform and Nuclei scanner at scale, confirming vulnerabilities via out-of-band callbacks and building a fresh inventory of exploitable systems. This reconnaissance activity is believed to support the Initial Access Broker (IAB) ecosystem, where access to compromised networks is sold to ransomware operators, setting the stage for targeted attacks throughout 2026. The campaign was traced to two IP addresses and involved over 57,000 unique OAST subdomains, highlighting the industrialization of vulnerability scanning and the supply chain of ransomware operations.
In parallel, threat actors have been observed actively targeting large language model (LLM) deployments, with campaigns exploiting server-side request forgery (SSRF) vulnerabilities and systematically mapping AI infrastructure. GreyNoise's honeypot infrastructure recorded over 91,000 attack sessions, including a dramatic spike in activity during the Christmas period, with attackers using similar OAST infrastructure and automation tooling as seen in the broader scanning campaign. These activities underscore the growing threat posed by automated, large-scale reconnaissance and exploitation efforts, which are increasingly targeting both traditional IT assets and emerging AI platforms, and are likely to drive a new wave of intrusions and ransomware attacks in 2026.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On January 8, 2026, GreyNoise published details of the December 25-28 reconnaissance campaign, saying the operation scanned for more than 240 exploit types and likely served as groundwork for 2026 ransomware attacks. It advised organizations to review logs for the identified IPs and OAST domains because successful callbacks may indicate confirmed vulnerabilities now potentially for sale.
By January 8, 2026, GreyNoise disclosed that its Ollama honeypots had recorded more than 91,000 attack sessions from October 2025 through January 2026, documenting both SSRF exploitation attempts and large-scale endpoint enumeration. The company warned that exposed LLM endpoints were likely already being prepared for future exploitation.
Between December 25 and 28, 2025, the same holiday scanning operation entered a second wave that added more exploit templates and continued cataloging exploitable internet-facing systems. GreyNoise assessed the timing as likely intended to take advantage of reduced holiday security staffing.
On December 25, 2025, a single operator began an internet-wide reconnaissance campaign using two CTG Server Limited IP addresses to scan for hundreds of exploits. The activity used Nuclei and Interactsh OAST domains to confirm vulnerable systems, behavior consistent with an initial access broker collecting targets.
Between late 2025 and January 2026, two threat-actor IPs systematically enumerated more than 73 LLM model endpoints across major providers including OpenAI, Anthropic, Meta, Google, Mistral, Alibaba, DeepSeek, and xAI. GreyNoise linked the infrastructure to known CVE-exploitation activity and said the enumeration campaign generated more than 80,000 sessions in 11 days.
GreyNoise observed the start of campaigns against AI deployments in October 2025, with attackers probing Ollama and related integrations. One campaign exploited SSRF paths in Ollama model pulls and Twilio SMS webhooks, using ProjectDiscovery OAST infrastructure to validate callbacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat activity observed in late 2025 and early 2026 shows **high-volume, automated probing** of emerging and legacy internet-facing attack surfaces, including exposed large language model (LLM) endpoints. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure, attributing the traffic to two operations systematically enumerating AI deployments across major commercial model ecosystems (including OpenAI, Google, Anthropic, Meta, and others). One operation used two IP addresses to methodically test API formats and identify live endpoints across dozens of LLM targets while relying on innocuous prompts (for example, simple greetings and basic trivia questions) to reduce the likelihood of detection; GreyNoise noted the source IPs had prior associations with exploitation of known vulnerabilities, suggesting reconnaissance intended to feed follow-on exploitation. In parallel, Check Point Research detailed an updated, modular **GoBruteforcer** botnet variant that compromises Linux servers by **brute-forcing weak credentials** across common services (including FTP, MySQL, PostgreSQL, and *phpMyAdmin*), then reuses newly compromised hosts to expand scanning and password-guessing at scale. Check Point assessed that **50,000+ internet-facing servers** may be exposed to this activity, citing two drivers: widespread reuse of **AI-generated deployment/configuration examples** that propagate predictable usernames and weak defaults, and continued exposure of legacy stacks (such as *XAMPP*) with insufficient hardening. The newer GoBruteforcer variant reportedly adds more sophisticated capabilities and obfuscation, and the operators appear financially motivated, with activity linked to data theft, selling initial access, and cryptocurrency theft.
Jun 29, 2026
Security telemetry indicates **coordinated, large-scale probing of exposed LLM endpoints** consistent with pre-exploitation reconnaissance. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure (Oct–Jan), attributing activity to two operations systematically enumerating AI deployment weaknesses across major model ecosystems (including **OpenAI, Google Gemini, Anthropic, Meta, DeepSeek, Mistral, Alibaba, and xAI**). One operation used two IPs to methodically test API formats and identify live endpoints over an 11‑day period, relying on low-noise prompts (e.g., “hi” and simple factual questions) to reduce detection; GreyNoise noted the IPs’ prior association with exploitation of known vulnerabilities, suggesting reconnaissance feeding a broader exploitation pipeline. In parallel, Check Point described an active **GoBruteforcer (GoBrut) botnet** wave targeting cryptocurrency and blockchain project databases by brute-forcing services such as **FTP, MySQL, PostgreSQL, and phpMyAdmin** on Linux, with campaigns amplified by **reused AI-generated deployment examples** that propagate common usernames and weak defaults, plus exposure from legacy stacks like *XAMPP*. The Register’s coverage of the WEF Global Cybersecurity Outlook 2026 aligns with these observations at a strategic level, reporting that leaders increasingly prioritize **AI security risk assessment** and cite **data leakage** and adversary capability gains as top concerns; however, broader policy and CIO “challenges” commentary does not materially add to the specific reconnaissance/botnet activity described in the threat reporting.
Jun 29, 2026
Threat actors continue to prioritize internet-facing infrastructure that provides high-leverage initial access, with multiple reports highlighting **active exploitation of remote code execution (RCE) paths** in widely deployed services. A DFIR case study described attackers exploiting **Apache ActiveMQ** `CVE-2023-46604` by sending a crafted OpenWire command that forced the broker to load a remote Spring XML configuration, leading to payload retrieval via `certutil`, rapid privilege escalation to **SYSTEM**, credential dumping from **LSASS**, and eventual **LockBit** ransomware deployment via **RDP** after re-entry using previously stolen privileged credentials. Separately, incident-response reporting warned of ongoing exploitation against **Managed File Transfer (MFT)** products, including Gladinet *CentreStack* (an LFI issue `CVE-2025-11371` used in an exploit chain culminating in RCE, patched as `CVE-2025-30406`) and Fortra *GoAnywhere MFT* (`CVE-2025-10035`, improper deserialization leading to RCE), with observed activity linked to a threat group associated with **Medusa** ransomware. Broader telemetry and research reinforced that edge and externally exposed services remain the primary battleground for initial access at scale. GreyNoise reported nearly **3 billion** malicious sessions against edge infrastructure in 2H 2025, with heavy targeting of enterprise VPNs (notably **Palo Alto GlobalProtect**) and continued exploitation attempts for older issues such as `CVE-2020-2034`, alongside pervasive scanning of **SSH** and remote access services. In parallel, financially motivated and cybercrime-enabling ecosystems are improving their ability to reach victims: Varonis detailed **1Campaign**, a cloaking service that helps malicious **Google Ads** evade review by serving benign pages to scanners while directing real users to phishing/crypto-drainer content, and Have I Been Squatted documented **Diesel Vortex**, a logistics-focused credential-phishing operation using dozens of domains and an exposed backend repository to support industrialized theft. These trends align with reporting that attackers are increasingly using **AI-assisted social engineering and tooling** (including deepfakes and AI-generated phishing) and with law-enforcement actions such as Interpol-backed **Operation Red Card 2.0**, which resulted in **651 arrests** and $4.3M recovered from cyber-enabled fraud activity across 16 African countries.
Jun 29, 2026