It Was Not Me! Malware-Initiated Vulnerability Scanning Is on the Rise

Unit 42 describes a growing trend of malware-initiated scanning attacks in which infected hosts (notably Mirai variants) are instructed by C2 to scan and exploit widely used vulnerabilities—such as MOVEit CVE-2023-34362, Zyxel RCE, and multiple Ivanti CVEs—resulting in millions of scan requests and major spikes of tens of thousands of unique targets; the report provides telemetry, case studies, IoCs (IPs, URLs, a SHA256), and mitigation recommendations using Palo Alto Networks products.