Observing Attacks Against Hundreds of Exposed Services in Public Clouds
Summary: Unit 42 deployed 320 honeypots across North America, Asia Pacific and Europe between July and August 2021, running RDP, SSH, SMB and Postgres instances with weak credentials like admin:admin, and found 80% were compromised within 24 hours and all within a week. Attackers discovered and compromised the honeypots in minutes, and blocking known scanner IPs made no significant difference in attack volume between the control and experimental groups.
Why it matters: Your vulnerability management cycle is measured in days or months, while attackers found and compromised these services in minutes - and 85% of attacker IPs appeared on only a single day, so an IP blocklist built today is stale tomorrow.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026