GreyNoise Report Highlights Edge Targeting, Fresh Attack Infrastructure and LLM Scanning
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
GreyNoise's 2026 State of the Edge report analyzes 2.97 billion sessions from H2 2025, highlighting sustained edge targeting, previously unseen sources behind 52% of RCE attempts, and emerging attacks on exposed LLM infrastructure.
Key points
- GreyNoise analyzed 2.97 billion sessions from 3.8 million source IPs across July 23–December 31, 2025. Its sensors observe attempts, not confirmed compromises of production systems.
- Palo Alto Networks targeting accounted for 16.7 million sessions, including login scanning, CVE-2020-2034 attempts and brute force—more than Cisco and Fortinet combined.
- Sources with no prior history in GreyNoise telemetry generated 52% of RCE attempts, highlighting limitations of reputation-only defenses.
- A US RDP credential-spraying campaign grew from 2,000 to roughly 300,000 participating IPs over 72 days; 73% were classified as residential.
- React2Shell exploitation generated 5.93 million sessions. MEVSPACE supplied 44.5% of traffic, while two JA4H fingerprints covered 73%, suggesting concentrated automation.
- Pre-2015 CVEs generated 7.3 million sessions, although CVE-1999-0526 information-disclosure probing accounted for 87% of that total.
- Separately, GreyNoise observed 91,403 sessions targeting Ollama between October 2025 and January 2026. It recommends restricting exposed AI services, patching edge devices, enforcing MFA and complementing blocklists with behavioral detection.
Article Details
- Publisher
- GreyNoise Intelligence, Inc.
- Report Period
- 2025-07-23 to 2025-12-31; supplementary AI infrastructure observations through January 2026
- Scope
- Unsolicited internet traffic observed by the GreyNoise Global Observation Grid across 80+ countries. Telemetry measures scanning and exploitation attempts, not confirmed production compromises; third-party findings are separately attributed.
- Sample Size
- 2,969,010,478 sessions from 3,804,232 unique source IPs over 162 days; known benign scanners and spoofable traffic excluded.
- Key Statistics
- 52% of remote code execution attempts originated from IPs with no prior history in GreyNoise data; the report notes infrastructure rotation, newer campaigns, and sensor selection effects as possible explanations.
- A credential-spraying operation targeting US Remote Desktop services grew from approximately 2,000 to 300,000 participating IPs over 72 days; 73% were classified as residential, primarily in Brazil and Argentina.
- CVE-2025-55182 exploitation generated 5.93 million sessions from 6,932 unique IPs; MEVSPACE accounted for 44.5% of sessions, and two JA4H fingerprints accounted for 73%.
- Pre-2015 CVEs generated 7.3 million sessions versus 1.8 million for 2023–2024 CVEs; CVE-1999-0526 alone accounted for 87% of the pre-2015 total.
- GreyNoise observed 91,403 sessions targeting Ollama between October 2025 and January 2026, including 80,469 enumeration sessions reported between 2025-12-28 and 2026-01-08.
- Recommendations
- Enforce MFA on edge devices, monitor authentication logs for password spraying, and use key-based authentication for SSH.
- Inventory exposed AI/LLM infrastructure, require authentication, restrict network access, patch affected platforms, and monitor model enumeration and port 11434 probing.
- Patch VPN appliances, including CVE-2020-2034, update router firmware, restrict management interfaces, and audit legacy systems for older unpatched vulnerabilities.
- Complement reputation blocklists with behavioral detection and JA4/JA4H clustering; prioritize investigation of previously unseen IPs attempting remote code execution.
- Develop ASN-level blocking playbooks for concentrated exploitation activity and assess residential proxy detection capabilities.
MITRE ATT&CK
T1110.001 · Password GuessingThe report documents brute-force attempts against GlobalProtect, RouterOS, SSH, and Remote Desktop authentication.T1110.003 · Password SprayingA coordinated operation used distributed residential infrastructure for credential spraying against US Remote Desktop services.T1190 · Exploit Public-Facing ApplicationSensors observed exploitation attempts against internet-facing services, including CVE-2025-55182 activity progressing from scanning to reverse shell payload delivery.T1496 · Resource HijackingAccording to Darktrace, malware exploiting React2Shell installed XMRig on 91 hosts; the report also describes third-party findings of unauthorized monetization of exposed LLM compute access.T1595 · Active ScanningGreyNoise observed internet-wide scanning of VPN appliances, routers, remote access services, and LLM inference endpoints.
CVE
CVE-1999-0526| **CVE-1999-0526** | X Server Info Disclosure | 6.35M | 26 years old. Primarily reconnaissance, but volume indicates large number of exposed legacy systems |CVE-2012-1823However, even excluding it, Shellshock (CVE-2014-6271), PHP-CGI (CVE-2012-1823), and Oracle WebLogic vulnerabilities from 2017–2019 continue to see systematic probing.CVE-2014-6271However, even excluding it, Shellshock (CVE-2014-6271), PHP-CGI (CVE-2012-1823), and Oracle WebLogic vulnerabilities from 2017–2019 continue to see systematic probing.CVE-2020-2034| **CVE-2020-2034** | Palo Alto PAN-OS Injection | 3.75M | Five years old. Sustained targeting suggests continued presence of unpatched systems |CVE-2025-47277vulnerabilities in 2025–2026—including remote code execution via unsafe deserialization (CVE-2025-47277, CVSS 9.8) and RCE via malicious video URLs submitted to multimodal API endpoints (CVE-2026-22778).CVE-2025-551822. **React2Shell (CVE-2025-55182)** showed coordinated infrastructure: 44.5% of exploitation came from a single hosting provider, and two JA4H fingerprints accounted for 73% of sessions—indicating shared toolingCVE-2025-63389Ollama itself has multiple critical CVEs including missing authentication on all management operations (CVE-2025-63389).CVE-2026-22778(CVE-2025-47277, CVSS 9.8) and RCE via malicious video URLs submitted to multimodal API endpoints (CVE-2026-22778).
Threat Actors
APT28The report cites CERT-UA reporting that APT28 deployed LAMEHUG with embedded LLM-based command generation on compromised hosts.Void DokkaebiThe report cites CrowdStrike reporting that this North Korea-linked group infiltrated more than 320 companies in 12 months using generative AI throughout its recruitment deception.
Malware
Vendors
Amazon Web ServicesUCLOUD (AS135377) generated more malicious traffic than AWS and Azure combined.AsusMikroTik Routers (~15.7M), Remote Desktop (RDP) (~14.2M), Cisco SSL VPN (~3.0M), Telnet Services (~2.9M), ASUS Routers (~1.7M), Fortinet SSL VPN (~1.6M).Cisco1. **Palo Alto GlobalProtect** received 16.7 million sessions—more than 3.5× Cisco and Fortinet combined. This concentration is not proportional to market share; it reflects deliberate selection.DigitalOceanchart showing malicious session volume and percentage share by provider: UCLOUD (AS135377) 392M (14%), DigitalOcean (AS14061) 222M (7.5%), Pfcloud (AS51396) 107M (3.6%), AWS (AS16509) 80M (2.7%), Azure (AS8075) 59MFortinetfour most frequently exploited vulnerabilities in 2024 were all in edge devices—Palo Alto, Ivanti, and Fortinet (Mandiant M-Trends 2025). The Verizon 2025 DBIR found edge device vulnerability exploitation grew 8-foldMevspace- [Campaign Concentration: MEVSPACE and React2Shell](#campaign-concentration-mevspace-and-react2shell)Microsoft AzureUCLOUD (AS135377) generated more malicious traffic than AWS and Azure combined.MikroTik*Palo Alto, MikroTik, and RDP probes + exploits account for 84% of edge infrastructure attacks*Palo Alto Networks- [Palo Alto Networks Targeting](#palo-alto-networks-targeting)UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDUCLOUD (AS135377) generated more malicious traffic than AWS and Azure combined.
Products
GlobalProtect1. **Palo Alto GlobalProtect** received 16.7 million sessions—more than 3.5× Cisco and Fortinet combined. This concentration is not proportional to market share; it reflects deliberate selection.MikroTik RouterOS| MikroTik RouterOS Bruteforcer | 15.7M |Ollamaare already being scanned by the same actors and tooling targeting traditional edge devices. With 175,000 Ollama servers exposed globally, AI infrastructure is now part of the attack surface.PAN-OS| **CVE-2020-2034** | Palo Alto PAN-OS Injection | 3.75M | Five years old. Sustained targeting suggests continued presence of unpatched systems |vLLMvLLM, a widely adopted open-source LLM inference engine, disclosed seven critical and high-severity vulnerabilities in 2025–2026—including remote code execution via unsafe deserialization (CVE-2025-47277, CVSS 9.8) and
Tools
Countries
Argentina2. **Geographic and IP-based controls fail against residential botnets.** 300,000 residential IPs from Brazil and Argentina—with no prior malicious history—bypassed every traditional perimeter control.Brazil2. **Geographic and IP-based controls fail against residential botnets.** 300,000 residential IPs from Brazil and Argentina—with no prior malicious history—bypassed every traditional perimeter control.North Korea- **CrowdStrike reported that North Korea's FAMOUS CHOLLIMA infiltrated 320+ companies in 12 months** using GenAI at every stage—deepfake video interviews, AI-generated resumes, AI-assisted coding challenges—a 220%United StatesUS sources lead because that 's where cloud providers are based.*