At The Edge Clear: Feb 23 - Mar 2, 2026

Summary: GreyNoise's brief for February 23 to March 2, 2026 reports global scanning volume fell 37% in a single day as major operations went dark, while Sophos exploitation rose 435%, RDP scanning reached 9.1 million sessions, and VPN credential campaigns ran a sixth consecutive week. Combined CVE-2022-1040 exploitation and user portal probing hit 276,358 sessions, a fivefold increase, and a dedicated MEVSPACE operation pushed port 3389 from the 13th to the 3rd most-targeted destination port.
What's compelling: The drop in overall scanning did not slow the campaigns aimed at enterprise perimeters: CVE-2022-1040 probing grew fivefold to 276,358 sessions, and exposed RDP remains the primary ransomware entry vector.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2022-1040
Related: CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022
Attackers target Ukraine using GoMet backdoor Cyber Risks ·
At The Edge Clear: March 2 – 9, 2026 Cyber Risks ·