Post

That which was originally a private customer threat intel share in our weekly At The Edge reports is now a public blog post! www.greynoise.io/blo... This is a deep dive into a massive reconnaissance campaign that unfolded between December 25–28. 1/4

greynoise.ioThe Ransomware Ground Game: How A Christmas Scanning Campaign Will Fuel 2026 AttacksOver four days in December, one operator scanned the internet with 240+ exploits, logging confirmed vulnerabilities that could power targeted intrusions in 2026.

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈

@hrbrmstr.dev

A single operator systematically scanned the internet, testing 240+ different exploits to build a fresh inventory for 2026 ransomware attacks. Key Takeaways: * Timing is everything: Attackers used the holiday skeleton crew window to scan unimpeded for 4 days. 2/4

8/1/26, 3:00 pm0 reposts0 likes

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈

@hrbrmstr.dev

8 Jan

* The IAB Model: This wasn't a direct hit; it was a "restocking" of the Initial Access Broker market. * Infrastructure: The activity originated from a suspicious hosting provider (CTG Server Limited) with a history of phishing and abuse. 3/4

hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈

@hrbrmstr.dev

8 Jan

If your systems were hit during this window, the vulnerability data may already be for sale. Links to IoCs are in the post. 4/4