Coordinated Brute Force Activity Targeting Apache Tomcat Manager Indicates Possible Upcoming Threats

Summary: GreyNoise observed a coordinated spike in malicious activity against Apache Tomcat Manager interfaces on June 5, 2025, with its Tomcat Manager Brute Force Attempt and Tomcat Manager Login Attempt tags registering well above baseline volumes. Roughly 400 unique IPs were involved, most narrowly focused on Tomcat services, with a significant portion originating from DigitalOcean infrastructure (ASN 14061).
Why it matters: Roughly 400 IPs probing Tomcat Manager at once is broad, opportunistic activity that GreyNoise treats as an early warning of future exploitation - and it is not tied to a specific vulnerability, so there is no patch to wait for.

Read the original at GreyNoise Blog ↗