At The Edge Clear: April 06 - 13, 2026
Summary: GreyNoise reports that six AWS-hosted nodes sharing a single JA3 fingerprint systematically probed Fortinet, Palo Alto, Sophos, Ivanti, Citrix, ConnectWise, and F5 appliances in one coordinated operation active since January. For the April 06-13, 2026 period, it also recorded 1,535,690 sessions against the FortiClient EMS authentication bypass (CVE-2026-35616, CVSS 9.1, CISA KEV), a 76.9% rise in Mirai activity alongside a 28.3% drop in overall volume, and 93.6% growth in Ollama API endpoint scanning.
Bottom line: One operation with a single JA3 fingerprint is walking your entire perimeter stack at once, and the FortiClient EMS flaw alone drew more than 1.5 million sessions while SSL VPN brute-forcing climbed alongside it. Meanwhile Ollama endpoint scanning is up thirteenfold in three weeks, meaning someone is cataloging exposed AI inference infrastructure before deciding what to do with it.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-35616
- Related
- CVE-2026-35616: Fortinet Forti Client EMS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Apr 06, 2026University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026