At The Edge Clear: Feb 2–9, 2026
Summary: GreyNoise recorded 29.9 million password-guessing attempts against Remote Desktop in the February 2–9, 2026 analysis period, up 113% from 14 million the prior week, with one IP generating 6.75 million sessions alone. Three independent campaigns targeted CVE-2026-1281 - Netherlands malware delivery, Russian blind testing with 352 OAST domains, and US scanning co-located with active Cobalt Strike on port 34473 - alongside 83,334 attempts against CVE-2026-21858 from a single /24 block (AS211590) and 44,763 sessions from the Rondodox botnet.
Why it matters: Exposed RDP remains the top ransomware entry point, and the Rondodox botnet is reusing the same JA4T fingerprint as December's initial access broker campaign - the same infrastructure is coming back with a new vulnerability in hand.
Read the original at GreyNoise Blog ↗
- Topics
- Malware
- Mentions
- CVE-2026-1281CVE-2026-21858
- Related
- CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Known Exploited Vulnerabilities · Jan 29, 2026Critical Vulnerabilities in Ivanti EPMM Exploited Cyber Risks ·