Surge in networks scans targeting Cisco ASA devices raise concerns

GreyNoise and independent researchers observed a coordinated, large-scale scanning campaign in late August 2025 targeting Cisco ASA appliances and Cisco IOS Telnet/SSH, with spikes involving up to 25,000 unique IPs and a second wave largely driven by a ~17,000-IP Brazilian botnet; NadSec reported up to 200,000 hits within 20 hours. The scans used overlapping Chrome-like user agents suggesting a common origin and are consistent with reconnaissance that often precedes vulnerability disclosures; recommended mitigations include applying patches, enforcing MFA, avoiding direct exposure of ASA management interfaces, and using VPN concentrators, reverse proxies, geo-blocking, and rate limiting.