At The Edge Clear: May 11 - 18, 2026

Summary: GreyNoise reports that SonicWall VPN targeting reversed a documented 92.9% decline during May 11-18, 2026, with credential attacks and management API scanning hitting at a near 1:1 ratio and making SonicWall 72.2% of all enterprise VPN-targeted activity. The same brief describes a three-IP cluster probing non-standard VNC ports 5902-5910, two independent clusters (one Netherlands-based, one AWS-hosted) converging on ConnectWise ScreenConnect CVE-2024-1709 (CVSS 10.0), and Realtek CVE-2014-8361 active in 15 botnets across 6,219 malicious IPs.
What's compelling: GreyNoise's Ten Days Before Zero research says this SonicWall pattern has preceded new vulnerability disclosures by a median of 11 days - so the 72.2% session spike may be a countdown, not just noise.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2014-8361 CVE-2024-1709
Related: CVE-2024-1709: Connect Wise Screen Connect Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Feb 22, 2024
CVE-2014-8361: Realtek SDK Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Sep 18, 2023
IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability Cyber Risks ·