Coordinated One-Day Cloud Scanning Operation Targets 75 Exposure Points (Campaign)
ID: 740fce8f-09e3-5e96-b217-50ae2e2bfa75
STIX ID: report--740fce8f-09e3-5e96-b217-50ae2e2bfa75
Feed Name: Wiz Cloud Threat Landscape
Date Published: 2025-05-28
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
On May 8, 2025 GreyNoise observed a tightly coordinated one-day reconnaissance campaign from 251 AWS-hosted IPs geolocated in Japan that triggered 75 distinct scanning behaviors across ColdFusion, Tomcat, Elasticsearch, WebLogic, WordPress, Drupal, IoT devices, and more; scans targeted legacy CVEs and misconfigurations and used ephemeral, synchronized infrastructure indicative of centralized orchestration and potential pre-exploitation activity.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.