At The Edge Clear: May 27 - June 01, 2026
Summary: GreyNoise's May 27 to June 1, 2026 analysis period recorded a 243M-session week in which two IPs in 85.11.167.0/24 (Netherlands, AS209630) generated 7,190,652 combined sessions, about 3.0% of the corpus and 4.1x the next-largest single emitter. Fortinet SSL VPN bruteforcing drew 832,516 sessions, 4.7x Cisco and 8.5x Palo Alto volume, while WannaCry-family SMB probing held at 2,612,131 sessions and eight Google Cloud IPs across eight regional ranges added roughly 3.4M sessions.
Key Takeaway: The Fortinet credential pressure is 8.5x the Palo Alto volume, aimed at the largest enterprise install base, and the WannaCry SMB probing at 2.6M sessions nine years after the outbreak suggests internet-exposed SMBv1 endpoints are still being found at density.
Read the original at GreyNoise Blog ↗
- Mentions
- CVE-2020-2034CVE-2022-36553
- Related
- At The Edge Clear: May 19 - 25, 2026 Cyber Risks ·