Loading story…
Threat reporting and incident investigations show network service discovery has become a routine precursor to both ransomware deployment and state-backed intrusion activity. MITRE ATT&CK catalogs this behavior as technique T1046, covering port scanning, service enumeration, OS fingerprinting, and identification of exposed technologies such as Docker, Kubernetes, ESXi, and ICS services. CISA also warned that Chinese Ministry of State Security-affiliated actors rapidly scan for newly disclosed vulnerabilities on internet-facing systems and then exploit flaws including CVE-2020-5902, CVE-2019-19781, CVE-2019-11510, and CVE-2020-0688, often following up with tools such as Cobalt Strike, China Chopper, and Mimikatz.
Ransomware case studies show the same reconnaissance pattern inside victim networks. Hunt & Hackett reported that Advanced IP Scanner is frequently used during targeted intrusions and leaves useful Windows registry artifacts under HKEY_USERS\<SID>\SOFTWARE\famatech\advanced_ip_scanner, including scanned ranges and search history. Analysis of Conti source code found the malware derives internal subnets from the ARP table, scans hosts over SMB port 445, and enumerates shares with NetShareEnum, while Cisco Talos documented Maze operators using Cobalt Strike, RDP, WMIC, PowerShell, and 7-Zip during prolonged lateral movement and data theft before encryption. Separately, Intrinsec linked large-scale mass-scanning and brute-force traffic to BtHoster-associated bulletproof hosting networks that also hosted malware and command-and-control infrastructure, underscoring how scanning activity is supported by resilient criminal infrastructure.
Get the actors, campaigns, and ATT&CK mapping behind it.
10 events from the most recent confirmed update back to the earliest known activity.
On March 5, 2025, security analyst Jo Provost reported that CIPHER OPERATIONS DOO BEOGRAD, UAB Host Baltic, and Amwaj Alkhyr all announced prefix 81.30.107.0/24 in activity associated with suspected BGP hijacking. Intrinsec later cited this as part of its analysis of prefix movements tied to abusive infrastructure.
Intrinsec concluded with high confidence that Inside Network LTD (AS215476) and Skynet Network Ltd (AS214295) were operated by the bulletproof hosting provider BtHoster. The report also tied related infrastructure, upstream providers, and retained Iranian prefix descriptions to efforts to support scanning, brute-force activity, and malware hosting while obscuring attribution.
Intrinsec recorded around 61,724 attacks against its honeypots from SS-Net (AS204428) between February 17 and March 17, 2025. The report linked SS-Net to the 4Vendeta bulletproof hosting ecosystem with high confidence.
Intrinsec reported that its honeypots observed increasing attacks between February and March 2025 from small autonomous systems including Skynet Network Ltd and SS-Net-linked infrastructure. The activity included large volumes of brute-force and mass-scanning traffic.
Intrinsec reported that Inside Network LTD (AS215476), later linked with high confidence to BtHoster, was allocated in February 2024 and announced prefix 77.90.185.0/24. The report said this prefix had previously been announced by BtHoster LTD (AS198465).
Intrinsec said UAB Host Baltic had been used in 2024 for spam campaigns delivering XLoader malware. This was cited as part of the broader abusive infrastructure history surrounding networks later tied to BtHoster operations.
A public analysis of Conti ransomware source code described how the malware derives internal subnets from the ARP table, scans hosts on SMB port 445, and enumerates shares with NetShareEnum. The post also covered Conti's drive enumeration, process-killing logic, and a YARA rule with Conti-related strings.
Hunt & Hackett reported that Advanced IP Scanner was regularly used in targeted ransomware intrusions by actors including Conti, REvil, DarkSide/UNC2465, Ryuk/UNC1878, Egregor, Hades/Evilcorp, UNC2447, Dharma, and an unnamed Iranian actor. The article documented Windows registry artifacts and detection approaches for identifying the tool's execution and internal scanning behavior.
CISA, with FBI contributions, issued a joint advisory describing Chinese MSS-affiliated actors rapidly scanning for newly disclosed vulnerabilities and exploiting flaws such as CVE-2020-5902, CVE-2019-19781, CVE-2019-11510, and CVE-2020-0688. The advisory emphasized that these actors used common tools including Cobalt Strike, China Chopper, and Mimikatz against U.S. Government and other targets.
Cisco Talos published incident response findings on multiple targeted Maze ransomware intrusions in which the same adversary used Cobalt Strike, lateral movement, 7-Zip, PowerShell/FTP exfiltration, and then deployed Maze ransomware. Talos also linked at least two incidents to the same adversary and released related indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecocomelonc.github.io
Open sourcehuntandhackett.com
Open sourceus-cert.cisa.gov
Open sourceblog.talosintelligence.com
Open sourceintrinsec.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
A significant internet-wide scanning campaign was observed over the 2025 Christmas holiday, where a single operator systematically probed for vulnerable systems using more than 240 different exploits. The attacker leveraged ProjectDiscovery's Interactsh platform and Nuclei scanner at scale, confirming vulnerabilities via out-of-band callbacks and building a fresh inventory of exploitable systems. This reconnaissance activity is believed to support the Initial Access Broker (IAB) ecosystem, where access to compromised networks is sold to ransomware operators, setting the stage for targeted attacks throughout 2026. The campaign was traced to two IP addresses and involved over 57,000 unique OAST subdomains, highlighting the industrialization of vulnerability scanning and the supply chain of ransomware operations. In parallel, threat actors have been observed actively targeting large language model (LLM) deployments, with campaigns exploiting server-side request forgery (SSRF) vulnerabilities and systematically mapping AI infrastructure. GreyNoise's honeypot infrastructure recorded over 91,000 attack sessions, including a dramatic spike in activity during the Christmas period, with attackers using similar OAST infrastructure and automation tooling as seen in the broader scanning campaign. These activities underscore the growing threat posed by automated, large-scale reconnaissance and exploitation efforts, which are increasingly targeting both traditional IT assets and emerging AI platforms, and are likely to drive a new wave of intrusions and ransomware attacks in 2026.
Jun 29, 2026
Threat actors continue to prioritize internet-facing infrastructure that provides high-leverage initial access, with multiple reports highlighting **active exploitation of remote code execution (RCE) paths** in widely deployed services. A DFIR case study described attackers exploiting **Apache ActiveMQ** `CVE-2023-46604` by sending a crafted OpenWire command that forced the broker to load a remote Spring XML configuration, leading to payload retrieval via `certutil`, rapid privilege escalation to **SYSTEM**, credential dumping from **LSASS**, and eventual **LockBit** ransomware deployment via **RDP** after re-entry using previously stolen privileged credentials. Separately, incident-response reporting warned of ongoing exploitation against **Managed File Transfer (MFT)** products, including Gladinet *CentreStack* (an LFI issue `CVE-2025-11371` used in an exploit chain culminating in RCE, patched as `CVE-2025-30406`) and Fortra *GoAnywhere MFT* (`CVE-2025-10035`, improper deserialization leading to RCE), with observed activity linked to a threat group associated with **Medusa** ransomware. Broader telemetry and research reinforced that edge and externally exposed services remain the primary battleground for initial access at scale. GreyNoise reported nearly **3 billion** malicious sessions against edge infrastructure in 2H 2025, with heavy targeting of enterprise VPNs (notably **Palo Alto GlobalProtect**) and continued exploitation attempts for older issues such as `CVE-2020-2034`, alongside pervasive scanning of **SSH** and remote access services. In parallel, financially motivated and cybercrime-enabling ecosystems are improving their ability to reach victims: Varonis detailed **1Campaign**, a cloaking service that helps malicious **Google Ads** evade review by serving benign pages to scanners while directing real users to phishing/crypto-drainer content, and Have I Been Squatted documented **Diesel Vortex**, a logistics-focused credential-phishing operation using dozens of domains and an exposed backend repository to support industrialized theft. These trends align with reporting that attackers are increasingly using **AI-assisted social engineering and tooling** (including deepfakes and AI-generated phishing) and with law-enforcement actions such as Interpol-backed **Operation Red Card 2.0**, which resulted in **651 arrests** and $4.3M recovered from cyber-enabled fraud activity across 16 African countries.
Jun 29, 2026