At The Edge Clear: March 16-23, 2026
Summary: GreyNoise's March 16-23, 2026 analysis period recorded the MEVSPACE RDP operator returning from a 99.8% collapse, with a single IP generating 7,975,241 sessions across 10,000+ ports before going dark. Two IPs linked to the RondoDox threat operator weaponized 21+ CVEs against routers, cameras, and embedded devices from 12+ manufacturers across 2,042,092 sessions, while five nodes generated up to 5,854 unique JA3 fingerprints each during path traversal reconnaissance spanning 4,106,542 sessions.
Why it matters: An operator tracked since January 2026 has shown it can rebuild scanning capacity within days of a near-total collapse, and five nodes rotating thousands of JA3 fingerprints each mean fingerprint-based correlation alone will not surface the reconnaissance happening across 4.1 million sessions.
Read the original at GreyNoise Blog ↗
- Mentions
- CVE-2022-1040CVE-2023-1389
- Related
- CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability Known Exploited Vulnerabilities · May 01, 2023CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022Attackers target Ukraine using GoMet backdoor Cyber Risks ·