Do Son The JDY botnet, a China-nexus IoT network tied to Volt Typhoon, now spans 1,500+ devices and scans for new bugs like CVE-2026-35616 within hours.
reconnaissance
GreyNoise detects a coordinated surge in SonicWall reconnaissance. With over 84,000 scans, attackers are mapping VPNs for Akira and Fog ransomware strikes.
GreyNoise detected a coordinated mass scanning campaign where 7,000+ IPs (from 3xK GmbH) probed Palo Alto GlobalProtect portals and SonicWall SonicOS API endpoints using identical client fingerprints.
Microsoft Threat Intelligence details how APTs abuse Teams and Entra ID integration for recon, vishing, and C2. Attackers use RMM tools and spoofed accounts to breach enterprise environments.
A new GreyNoise report warns of two massive scanning spikes targeting Cisco ASA devices, raising concerns that attackers may be preparing to exploit a new vulnerability.
GreyNoise reports a massive, coordinated scanning campaign targeting Microsoft RDP services. Attackers are probing tens of thousands of IPs to prepare for future attacks.
FortiGuard Labs exposes NordDragonScan, a new infostealer using weaponized HTA scripts in Ukrainian-themed phishing. It performs recon, steals browser profiles, and exfiltrates documents.