Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day

Summary: On May 8, GreyNoise observed 251 malicious IP addresses geolocated to Japan and hosted on Amazon AWS trigger 75 distinct scanning behaviors in a single day, ranging from exploitation attempts for known CVEs to probes for misconfigurations and weak points in web infrastructure. Every IP was active only on May 8 with no noticeable activity immediately before or after, indicating temporary use of rented cloud infrastructure, and the level of overlap points to a single operator or toolset deployed across many temporary IPs.
What you should know: The campaign was a broad-spectrum search for any exposed system, particularly older edge infrastructure that may be overlooked in patch cycles, and the 2025 Verizon DBIR cited here flags the edge as a critical risk area with concerning time-to-mass-exploit and remediation lags.

Read the original at GreyNoise Blog ↗