At The Edge Clear: Feb 9-16, 2026
Summary: GreyNoise's February 9-16, 2026 analysis period recorded three attack surfaces accelerating at once: IoT botnet recruitment up 53-91% week-over-week, Fortinet SSL VPN brute-forcing nearly doubled, and credential harvesting more than doubled to 8.28 million sessions. The same brief cites a coordinated Iranian scanner cluster using custom tooling unknown to any public database, and an 84-day C2 operation disguised as API traffic to BitMart, KuCoin, and Bitget from a Japanese-hosted server.
Bottom line: An 84-day command-and-control operation that blended into cryptocurrency exchange API traffic means a dwell time measured in months, not days, and the Iranian cluster's custom tooling was invisible to every public database GreyNoise checks against.
Read the original at GreyNoise Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026