The Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 Attacks

Summary: Between December 25 and 28, a single operator running from two IP addresses on CTG Server Limited (AS152194) scanned the internet for vulnerable systems, testing 240+ exploits and sending requests every 1-5 seconds, with each target receiving 11 exploit types. The campaign used over 57,000 unique OAST subdomains tied to ProjectDiscovery's Interactsh to confirm vulnerabilities, ran in two waves 12 hours apart, and shared a Machine ID across 98% of attempts indicating one operator.
Key Takeaway: The vulnerability inventory harvested over that four-day holiday window does not expire with the campaign - it becomes a catalog that will likely power targeted intrusions throughout 2026, and access to a vulnerable corporate network sells in criminal marketplaces for a few thousand dollars or more.

Read the original at GreyNoise Blog ↗