At The Edge Clear: March 2 – 9, 2026
Summary: GreyNoise's March 2–9, 2026 analysis period recorded 51,801 Ollama model server scanning sessions (+37.9%), with the /api/tags model enumeration endpoint up 374%, and the first observed scanning for AI coding assistant configuration files from Cline, Aider, and Cursor targeting API keys, conversation histories, and cloud credentials. Chimay Red MikroTik exploitation rose 1,103% as two command IPs directed 6,046 compromised routers, while SMBv1, DCERPC, RFB/VNC, and Telnet surged simultaneously, with 39 of the top 50 source IPs shared between SMBv1 and DCERPC.
Bottom line: Two command IPs controlling 6,046 compromised MikroTik routers is a ready-made launch platform, and the same week brought the first scanning for Cline, Aider, and Cursor configuration files holding API keys and cloud credentials.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-1040
- Related
- Attackers target Ukraine using GoMet backdoor Cyber Risks ·CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022