Grey Noise Releases 2026 State of the Edge Report: More Than Half of Remote Code Execution Attempts Originate From Previously Unseen IPs
Summary: GreyNoise analyzed 2,969,010,478 malicious sessions from 3,804,232 unique source IPs collected across 80+ countries between July 23 and December 31, 2025, targeting VPN appliances, routers, and remote access services. The report found that 52% of remote code execution attempts came from IPs with no prior GreyNoise history, that pre-2015 CVEs generated 7.3 million sessions versus 1.8 million for 2023-2024 CVEs, and that a credential-spraying botnet against US Remote Desktop services grew from 2,000 to 300,000 IPs in 72 days.
What you should know: More than half of the highest-severity exploitation attempts came from infrastructure with no prior history, and a single botnet scaled 150-fold in 72 days using mostly residential IPs from Brazil and Argentina - the reputation feeds, blocklists, and geographic rules most edge defenses depend on would have missed both.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-1999-0526
- Related
- Grey Noise Releases 2026 State of the Edge Report Cyber Risks ·Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026