At The Edge Clear: Jan 26-30, 2026
Summary: GreyNoise reports that a single JA4T signature linked React, Fortinet, Palo Alto, and ENV campaigns across 3.3 million sessions during January 26-30, 2026, alongside a 20 million-session VNC reconnaissance surge and two-week RouterOS persistence. Netherlands-based infrastructure enumerated VNC ports 5900-5920 across roughly 100 IPs, while MikroTik RouterOS brute force IPs logged 1.1 million authentication attempts and 1 million CVE-2025-55182 attempts came from the same top IPs rotating through 11 identical user agents across 6 platforms.
Key Takeaway: The VNC enumeration across ports 5900-5920 from roughly 100 IPs is the kind of reconnaissance that typically precedes credential attacks, and the RouterOS brute force continued without pause at 1.1 million attempts even as one IP dropped and a new one emerged.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2025-55182
- Related
- At The Edge Clear: Jan 19–23, 2026 Cyber Risks ·CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025