A Spike in the Desert: How Grey Noise Uncovered a Global Pattern of VOIP-Based Telnet Attacks

Summary: GreyNoise found roughly 90 malicious IPs in a rural New Mexico region of just over 3,000 people, all tied to a single provider, Pueblo of Laguna Utility Authority, with 100% of the traffic Telnet-based. Widening the search using GreyNoise tags, behavioral similarity, and Telnet patterns turned up about 500 IPs globally with similar traits, many linked to VOIP-capable devices and some likely Cambium Networks hardware that may run firmware affected by a 2017 remote code execution vulnerability.
Why it matters: About 500 exposed VOIP and edge devices are showing botnet-like behavior worldwide, and the New Mexico traffic stopped completely right after a GreyNoise team member posted about it publicly - then spiked again - which suggests someone is watching what defenders publish.

Read the original at GreyNoise Blog ↗