At The Edge Clear: March 9-16, 2026
Summary: For the March 9-16, 2026 analysis period, GreyNoise reports a single Hong Kong cloud provider surged nearly sevenfold to become the dominant source of internet scanning, deploying a new tunneled fingerprint at 29.3M sessions while Western providers declined simultaneously. The same brief notes Sophos CVE-2022-1040 nearly doubled for the fourth consecutive week, SonicWall VPN doubled, Dell NetExtender appeared for the first time, two Cisco CVSS 10.0 CVEs sit on CISA KEV, and RDP scanning surged 157%.
What you should know: Edge device exploitation is entering its fourth month and re-accelerating, with state-aligned and financially motivated actors converging on the same attack surface - and the criminal ecosystem's infrastructure rotation, including MEVSPACE's collapse and its replacement's disappearance, means blocklists age faster than the operators they target.
Read the original at GreyNoise Blog ↗
- Mentions
- CVE-2022-1040CVE-2025-55182
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022Attackers target Ukraine using GoMet backdoor Cyber Risks ·