It Was Not Me! Malware-Initiated Vulnerability Scanning Is on the Rise
Summary: Unit 42 telemetry shows threat actors increasingly launching vulnerability scans from malware-infected hosts rather than direct scans, with over 66 million requests in 2023 potentially tied to scanning activity. In one case, a Zyxel router exploit on June 19, 2023 involved at least 2,247 devices scanning 15,812 destination ISPs, and Ivanti vulnerability scans jumped from 25,268 unique hosts scanned by at least 15,645 infected hosts on Jan. 14, 2024 to 82,441 hosts scanned by at least 39,658 infected hosts four days later.
Bottom line: The scans come from compromised machines inside ordinary networks, so the source of the attack looks like a benign host rather than an attacker, and the payload or command-and-control URLs embedded in those requests are often new enough that security vendors have not yet blocked them.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-34362
- Related
- CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability Known Exploited Vulnerabilities · Jun 02, 2023