Cybersecurity researchers have disclosed particulars of a coordinated cloud-based scanning exercise that focused 75 distinct “publicity factors” earlier this month.
The exercise, noticed by GreyNoise on Might 8, 2025, concerned as many as 251 malicious IP addresses which can be all geolocated to Japan and hosted by Amazon.
“These IPs triggered 75 distinct behaviors, together with CVE exploits, misconfiguration probes, and recon exercise,” the risk intelligence agency mentioned. “All IPs had been silent earlier than and after the surge, indicating short-term infrastructure rental for a single operation.”
The scanning efforts have been discovered to have focused a wide selection of applied sciences from Adobe ColdFusion, Apache Struts, Apache Tomcat, Drupal, Elasticsearch, and Oracle WebLogic, amongst others.
The opportunistic operation ranged from exploitation makes an attempt for identified CVEs to probes for misconfigurations and different weak factors in internet infrastructure, indicating that the risk actors had been wanting indiscriminately for any vulnerable system
- Adobe ColdFusion — CVE-2018-15961 (Distant code execution)
- Apache Struts — CVE-2017-5638 (OGNL injection)
- Atlassian Confluence — CVE-2022-26134 (OGNL Injection)
- Bash — CVE-2014-6271 (Shellshock)
- Elasticsearch — CVE-2015-1427 (Groovy sandbox bypass and distant code execution)
- CGI script scanning
- Surroundings variable publicity
- Git config crawlers
- Shell add checks, and
- WordPress creator checks
An attention-grabbing facet is that the broad-spectrum scan was energetic solely on Might 8, with no noticeable change within the exercise earlier than or after the date.
GreyNoise mentioned 295 IP addresses had been scanned for CVE-2018-15961, 265 IPs for Apache Struts, and 260 IPs for CVE-2015-1427. Out of those, 262 IPs overlapped between ColdFusion and Struts and 251 IPs overlapped throughout all of the three vulnerability scans.
“This degree of overlap factors to a single operator or toolset deployed throughout many short-term IPs — an more and more widespread sample in opportunistic however orchestral scanning,” GreyNoise mentioned.
To mitigate the exercise, organizations are required to dam the malicious IP addresses instantly, though it bears noting that follow-up exploitation might emanate from completely different infrastructures.
