At The Edge Clear: May 19 - 25, 2026
Summary: GreyNoise's May 19-26, 2026 brief reports that rented, disposable infrastructure spent the week inventorying edge devices - routers, VPN gateways, and container control planes - to build target lists ahead of intrusion. The VPSVAULT operation (AS215925) added a second RouterOS Bruteforcer node, raising its tag to 1,938,001 sessions from 1,049,230, while a fingerprinted Netherlands cluster ran authentication-bypass checks and version scans against Fortinet, Ivanti, Pulse Secure, Sophos, and F5 appliances, including Palo Alto PAN-OS GlobalProtect (CVE-2020-2034).
What's compelling: The Fortinet SSL VPN Bruteforcer tag logged 875,138 sessions ecosystem-wide, and this is the initial-access gear whose exploitation repeatedly precedes ransomware - the reconnaissance is finished and the target lists already exist.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2020-2034CVE-2026-32746
- Related
- At The Edge Clear: May 27 - June 01, 2026 Cyber Risks ·Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026